Proxysvc

Executive Summary

Proxysvc is a Lazarus-derived DLL used stealthily since 2017 to deliver additional payloads into higher‑education systems. It functions both as an injected component and a standalone process, facilitating covert command-and-control channels. Its dual functionality allows attackers to maintain persistence while bypassing many conventional defense mechanisms, posing a serious risk to academic institutions.

Proxysvc is a clandestine Windows DLL that was employed by the North Korean Lazarus Group during its Operation GhostSecret campaign. First identified in 2017 targeting mainly higher‑education institutions, the module masquerades as legitimate software while functioning as both a loader and stand‑alone application. In DLL mode it is designed to be injected into trusted processes, allowing it to evade initial security scans by blending in with normal system activity. Once resident, Proxysvc acts primarily as a command-and-control (C2) relay that downloads and launches additional backdoor payloads. By serving as a dynamic dropper, the malware can keep lateral movement hidden within otherwise benign network traffic, making it difficult for defenders to pinpoint the original compromise. The ability to run both as an injected DLL and an autonomous executable increases its versatility across diverse system configurations. The combination of stealthy injection techniques and persistent payload delivery gives Proxysvc a substantial operational advantage. When left undetected, it can give attackers extended access to critical academic data, intellectual property, or infrastructure resources—making it a significant risk in environments that rely heavily on shared networks and research collaborations.

Key Capabilities

• acts as a dropper for secondary malware
• can be injected into legitimate Windows processes via DLL injection
• may execute independently as a standalone process
• establishes encrypted or obfuscated command‑and‑control channels
• dynamically downloads additional payloads from remote servers

ATT&CK Techniques

Recommended Actions

• Deploy endpoint detection solutions that flag unknown DLLs appearing in system32, SysWOW64, and temporary directories;
• Set up monitoring for anomalous inbound/outbound network traffic originating from non‑trusted processes;
• Implement application whitelisting to block execution of unapproved executable files; Whitelist only signed binaries in critical directories;
• Patch known Windows vulnerabilities that could facilitate DLL hijacking or process injection;
• Educate users at higher‑education institutions about suspicious email attachments and URLs that may host initial delivery vectors;

Suggested Tags