INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

Lazarus Group Deploys Infostealer in Spear-Phishing Campaign Against US Agencies

| 2026-10-28 07:56 LOW MEDIUM DATA BREACH MALWARE & BOTNETS
JSON
Executive Summary
AI-generated
The September 2026 Infostealer Trend Report, a summary of the distribution channels and information on companies targeted by new malware designed to steal information collected during the month of September 2026, was compiled based on detection logs from AhnLab Security intelligence Center (ASEC) and AhnLab products. The report includes data on the number of malware samples and detections, as well as details on Infostealers such as acrstealer, lzveil, remus, and vidar. These malicious entities were identified through indicators of compromise including Amazon AWS S3 URLs. The timeline for this incident spans September 2026, with a focus on the month's targeted companies.
Technical Mitigations AI-generated
• Block or hunt for the file <a href="/auth/login?next=/detail/MGVohqEBo0ihlvYp7BmT" class="ioc-censored-pill text-decoration-none" title="Protected IoC: Sign in to view" data-bs-toggle="tooltip"><span class="badge bg-black text-warning border border-warning border-opacity-75 font-monospace ioc-lock-tag align-middle"><i class="bi bi-lock-fill me-1"></i>[IOC HIDDEN &bull; LOGIN REQUIRED]</span></a> • Detect and patch the vulnerability in Amazon AWS S3 bucket at <a href="/auth/login?next=/detail/MGVohqEBo0ihlvYp7BmT" class="ioc-censored-pill text-decoration-none" title="Protected IoC: Sign in to view" data-bs-toggle="tooltip"><span class="badge bg-black text-warning border border-warning border-opacity-75 font-monospace ioc-lock-tag align-middle"><i class="bi bi-lock-fill me-1"></i>[IOC HIDDEN &bull; LOGIN REQUIRED]</span></a> • Use a product that detects lzveil malware, such as AhnLab products
Technical Observables 6 IoCs Login Required
Indicators of Compromise (IoCs) Protected

Raw threat telemetry, malicious IP addresses, file hashes, and direct VirusTotal correlation are restricted to authenticated users.

Sign In to View 6 IoCs Create Free Account
domains 1 md5 5
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
Target & Sectors
Global Scope
Incident Timeline
‎September 2026
Threat actors published a September 2026 Infostealer Trend Report, which is an infostealer malware report.
organisation Infostealer Trend Report
September 2026 Infostealer Trend Report.
‎the month of September 2026
Content This Infostealer Trend Report collected data on new Infostealers, including distribution channels and targeted companies, during the month of September 2026.
organisation Content This Infostealer Trend Report
Content This Infostealer Trend Report summarizes the distribution channels, number of malware samples, number of detections, and information on companies targeted by new Infostealers (malware designed to steal information) collected during the month of September 2026.
organisation Infostealers
Content This Infostealer Trend Report summarizes the distribution channels, number of malware samples, number of detections, and information on companies targeted by new Infostealers (malware designed to steal information) collected during the month of September 2026.
Intelligence Sources
AlienVault OTX 2026-10-28