WannaCry: Ransomware attacks show strong links to Lazarus group
Similarities in code and infrastructure indicate close connection to group that was linked to Sony Pictures and
Bangladesh Bank attacks
Tools and infrastructure used in the WannaCry ransomware attacks have strong links to Lazarus, the group that was
responsible for the destructive attacks on Sony Pictures and the theft of US$81 million from the Bangladesh Central
Bank.
Prior to the global outbreak on May 12, an earlier version of WannaCry (Ransom.Wannacry) was used in a small number of
targeted attacks in February, March, and April. This earlier version was almost identical to the version used in May
2017, with the only difference the method of propagation. Analysis of these early WannaCry attacks by Symantec’s
Security Response team revealed substantial commonalities in the tools, techniques, and infrastructure used by the
attackers and those seen in previous Lazarus attacks, making it highly likely that Lazarus was behind the spread of
WannaCry. Despite the links to Lazarus, the WannaCry attacks do not bear the hallmarks of a nation-state campaign but
are more typical of a cybercrime campaign. These earlier versions of WannaCry used stolen credentials to spread across
infected networks, rather than leveraging the leaked Eternal Blue exploit that caused WannaCry to spread quickly across
the globe starting on May 12.
Summary of links
· Following the first WannaCry attack in February, three pieces of malware linked to Lazarus were discovered on the
victim’s network: Trojan.Volgmer and two variants of Backdoor.Destover, the disk wiping tool used in the Sony Pictures
attacks.
· Trojan.Alphanc, which was used to spread WannaCry in the March and April attacks is a modified version of
Backdoor.Duuzer, which has previously been linked to Lazarus.
· Trojan.Bravonc used the same IP addresses for command and control as Backdoor.Duuzer and Backdoor.Destover, both of
which have been linked to Lazarus.
· Backdoor.Bravonc has similar code obfuscation as WannaCry and Infostealer.Fakepude (which has been linked to Lazarus).
· There is shared code between WannaCry and Backdoor.Contopee, which has previously been linked to Lazarus.
ends