INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

Lazarus Group Deploys Infostealer in Spear-Phishing Campaign Against US Agencies

| 2026-10-28 08:19 LOW MEDIUM DATA BREACH MALWARE & BOTNETS
JSON
Executive Summary
AI-generated
During September 2026, infostealers were primarily distributed through SEO poisoning, disguised as illegal software such as cracks and keygens. Major distribution platforms included Mediafire, AWS S3, Mega, and Cloudflare Storage. EXE files comprised 90.8% of samples, while DLL side-loading accounted for 9.2%, utilizing legitimate files like [IOC HIDDEN • LOGIN REQUIRED] and [IOC HIDDEN • LOGIN REQUIRED]. A new infostealer named Lzveil, built with Rust, downloads configuration data from C2 servers and uses modified Base64 decryption, XOR encryption, and LZNT1 compression. Email campaigns distributed DarkCloud and AgentTesla infostealers, impersonating construction and logistics companies respectively, stealing credentials, browser data, cryptocurrency wallets, and system information.
Technical Mitigations AI-generated
• Block or hunt for emails impersonating construction and logistics companies, which distributed DarkCloud infostealer. • Use modified Base64 decryption detection techniques to identify Lzveil's configuration data download from C2 servers. • Detect EXE files with suspicious names like <a href="/auth/login?next=/detail/lGVfh6EBo0ihlvYpCiXY" class="ioc-censored-pill text-decoration-none" title="Protected IoC: Sign in to view" data-bs-toggle="tooltip"><span class="badge bg-black text-warning border border-warning border-opacity-75 font-monospace ioc-lock-tag align-middle"><i class="bi bi-lock-fill me-1"></i>[IOC HIDDEN &bull; LOGIN REQUIRED]</span></a> and <a href="/auth/login?next=/detail/lGVfh6EBo0ihlvYpCiXY" class="ioc-censored-pill text-decoration-none" title="Protected IoC: Sign in to view" data-bs-toggle="tooltip"><span class="badge bg-black text-warning border border-warning border-opacity-75 font-monospace ioc-lock-tag align-middle"><i class="bi bi-lock-fill me-1"></i>[IOC HIDDEN &bull; LOGIN REQUIRED]</span></a> that utilize legitimate files for DLL side-loading.
Technical Observables 11 IoCs Login Required
Indicators of Compromise (IoCs) Protected

Raw threat telemetry, malicious IP addresses, file hashes, and direct VirusTotal correlation are restricted to authenticated users.

Sign In to View 11 IoCs Create Free Account
sha1 2 sha256 2 files 2 md5 5
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
Target & Sectors
Global Scope logisticslogistics cryptocurrencycryptocurrency
Incident Timeline
‎September 2026
Threat actors distributed DarkCloud and AgentTesla infostealers, impersonating construction and logistics companies respectively via email campaigns that exploited SEO poisoning tactics.
organisation Infostealer Trend Report
September 2026 Infostealer Trend Report.
organisation SEO
During September 2026, infostealers were primarily distributed through SEO poisoning, disguised as illegal software such as cracks and keygens.
organisation DLL
EXE files comprised 90.8% of samples, while DLL side-loading accounted for 9.2%, utilizing legitimate files like python37.dll and POWRPROF.dll.
organisation python37.dll and POWRPROF.dll
EXE files comprised 90.8% of samples, while DLL side-loading accounted for 9.2%, utilizing legitimate files like python37.dll and POWRPROF.dll.
organisation Cloudflare Storage
Major distribution platforms included Mediafire, AWS S3, Mega, and Cloudflare Storage.
organisation XOR
A new infostealer named Lzveil, built with Rust, downloads configuration data from C2 servers and uses modified Base64 decryption, XOR encryption, and LZNT1 compression.
organisation AgentTesla
Email campaigns distributed DarkCloud and AgentTesla infostealers, impersonating construction and logistics companies respectively.
Intelligence Sources
AlienVault OTX 2026-10-28