LazyScripter

Executive Summary

LazyScripter is a threat group primarily targeting the aviation sector since at least 2018, employing open-source tools such as njRAT and KOCTOPUS. Their tactics include spearphishing attacks using malicious links and attachments, leveraging JavaScript and PowerShell for execution.

Goals & Targeting

LazyScripter targets the airline industry due to its access to sensitive data and potential for disruption. The group likely aims to extract financial information, intellectual property, or disrupt operations for competitive advantage or monetary gains.

LazyScripter has consistently targeted the airline industry, indicating a strategic focus on sectors with sensitive data and potential operational disruption. They exploit open-source tools to maintain stealth and persistence, employing techniques like obfuscation and web service abuse. Their long-term presence suggests a capability for sustained campaigns aiming to achieve financial gain or espionage objectives.

Key Capabilities

• Use of njRAT malware
• KOCTOPUS toolset deployment
• Spearphishing campaigns
• Malicious scripts execution
• Persistence mechanisms

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

LazyScripter conducts targeted campaigns against airlines, utilizing njRAT and KOCTOPUS for long-term access. Their activities suggest a focus on data exfiltration and system disruption, with sustained operations potentially across multiple years.

IOC Patterns

• Web service domains linked to malicious activity
• Obfuscated JavaScript scripts delivered via spearphishing
• Fileless malware execution through Mshta or Rundll32
• Registry changes for persistence

Recommended Actions

• Monitor web services and domains for suspicious activities
• Implement network segmentation, especially for critical systems
• Enhance user training on phishing emails with malicious links/attachments
• Conduct regular vulnerability assessments focusing on aviation sector risks
• Use threat intelligence feeds to detect and block known LazyScripter IOC

Suggested Tags