LazyScripter G0140

Overview 21 indicators

LazyScripter is threat group that has mainly targeted the airlines industry since at least 2018, primarily using open-source toolsets.

Techniques 20 ATT&CK

Open in ATT&CK Navigator → or download the layer (20 techniques, layer 4.5)

• T1027.010 Command Obfuscation
• T1036 Masquerading
• T1059.001 PowerShell
• T1059.003 Windows Command Shell
• T1059.005 Visual Basic
• T1059.007 JavaScript
• T1071.004 DNS
• T1102 Web Service
• T1105 Ingress Tool Transfer
• T1204.001 Malicious Link
• T1204.002 Malicious File
• T1218.005 Mshta
• T1218.011 Rundll32
• T1547.001 Registry Run Keys / Startup Folder
• T1566.001 Spearphishing Attachment
• T1566.002 Spearphishing Link
• T1583.001 Domains
• T1583.006 Web Services
• T1588.001 Malware
• T1608.001 Upload Malware

Software 7

• Koadic
• QuasarRAT
• Remcos
• Empire
• njRAT
• ngrok
• KOCTOPUS

Principal sources 10 reports

Ranked by how many of this actor's indicators each report brought in.

• 19lab52.io/blog/very-very-lazy-lazyscripters-scrip…
• 19otx.alienvault.com/pulse/6228d0ba244cc5a2d6457b25
• 19virustotal.com/gui/ip-address/147.182.192.241/relations
• 19virustotal.com/gui/ip-address/185.81.157.186/relations
• 19virustotal.com/gui/ip-address/66.29.130.204/relations
• 19virustotal.com/gui/file/23ea10f4b1a73a4e8b13466fff8983…
• 2resources.malwarebytes.com/files/2021/02/LazyScripter.pdf
• 2otx.alienvault.com/pulse/603693b42a32d06720efad59

Related groups 4

What the sources have in common — not a claim that these are the same actor. See the whole graph.

• Gorgon Group G0078
  shares Remcos, njRAT, QuasarRAT
• APT-C-36 G0099
  shares Remcos, njRAT, QuasarRAT
• OilRig G0049
  shares ngrok
• Ember Bear G1003
  shares ngrok

Timeline 21 indicators

Each entry is a batch of indicators that appeared upstream on one date, under the report it was filed with.

No indicator matches. Only the most recent 300 are on this page — the rest are in the JSON.

1. 2022-03-10 8 domain, 1 ipv44 yrs ago

   lab52.io/blog/very-very-lazy-lazyscripters-scrip… · otx.alienvault.com/pulse/6228d0ba244cc5a2d6457b25 · virustotal.com/gui/ip-address/147.182.192.241/relations · virustotal.com/gui/ip-address/185.81.157.186/relations · virustotal.com/gui/ip-address/66.29.130.204/relations · virustotal.com/gui/file/23ea10f4b1a73a4e8b13466fff8983…

   domain	bsjsiq3ytpt3efsn6wnu3pukxil6q6plty6m6dcz.duckdns.org
   domain	gowaymevpslink1.xyz
   domain	gowaymevpslink2.xyz
   domain	gowaymevpslink3.xyz
   domain	gowaymevpslink4.xyz
   domain	gowaymevpslink5.xyz
   domain	smscs.publicvm.com
   domain	vistacp-enhance.duckdns.org
   ipv4	45.91.92.112:449

   copy batch

2. 2022-03-09 6 domain, 1 ipv44 yrs ago

   lab52.io/blog/very-very-lazy-lazyscripters-scrip… · otx.alienvault.com/pulse/6228d0ba244cc5a2d6457b25 · virustotal.com/gui/ip-address/147.182.192.241/relations · virustotal.com/gui/ip-address/185.81.157.186/relations · virustotal.com/gui/ip-address/66.29.130.204/relations · virustotal.com/gui/file/23ea10f4b1a73a4e8b13466fff8983…

   domain	gowaymevps.xyz
   domain	internetexploraldon.sytes.net
   domain	jbizgsvhzj22evqon9ezz8bmbupp1s6cprmriam1.duckdns.org
   domain	saqicpcgflrlgxgoxxzkbfrjuisbkozeqrmthrzo.duckdns.org
   domain	securessl.fit
   domain	u1153246fov.ha004.t.justns.ru
   ipv4	185.81.157.186:1995

   copy batch

3. 2021-03-02 1 domain5 yrs ago

   resources.malwarebytes.com/files/2021/02/LazyScripter.pdf · otx.alienvault.com/pulse/603693b42a32d06720efad59 · twitter.com/h2jazi/status/1366759252757512194 · virustotal.com/gui/file/0652962c5dace16ed170a932e3ce7e…

   varifsecuripass.duckdns.org

   copy batch

4. 2021-02-24 1 domain5 yrs ago

   resources.malwarebytes.com/files/2021/02/LazyScripter.pdf · otx.alienvault.com/pulse/603693b42a32d06720efad59 · twitter.com/h2jazi/status/1366759252757512194 · virustotal.com/gui/file/0652962c5dace16ed170a932e3ce7e…

   iatassl-telechargementsecurity.duckdns.org

   copy batch

5. 2021-01-13 1 url5 yrs ago

   lab52.io/blog/very-very-lazy-lazyscripters-scrip… · otx.alienvault.com/pulse/6228d0ba244cc5a2d6457b25 · virustotal.com/gui/ip-address/147.182.192.241/relations · virustotal.com/gui/ip-address/185.81.157.186/relations · virustotal.com/gui/ip-address/66.29.130.204/relations · virustotal.com/gui/file/23ea10f4b1a73a4e8b13466fff8983…

   http://185.81.157.186

   copy batch

6. 2020-09-27 1 domain6 yrs ago

   lab52.io/blog/very-very-lazy-lazyscripters-scrip… · otx.alienvault.com/pulse/6228d0ba244cc5a2d6457b25 · virustotal.com/gui/ip-address/147.182.192.241/relations · virustotal.com/gui/ip-address/185.81.157.186/relations · virustotal.com/gui/ip-address/66.29.130.204/relations · virustotal.com/gui/file/23ea10f4b1a73a4e8b13466fff8983…

   milla.publicvm.com

   copy batch

7. 2019-12-14 1 domain7 yrs ago

   lab52.io/blog/very-very-lazy-lazyscripters-scrip… · otx.alienvault.com/pulse/6228d0ba244cc5a2d6457b25 · virustotal.com/gui/ip-address/147.182.192.241/relations · virustotal.com/gui/ip-address/185.81.157.186/relations · virustotal.com/gui/ip-address/66.29.130.204/relations · virustotal.com/gui/file/23ea10f4b1a73a4e8b13466fff8983…

   stub.ignorelist.com

   copy batch

Further reading 12

• attack.mitre.org/groups/G0140
• web.archive.org/web/20211003035156/https://www.malwareb…
• virustotal.com/gui/file/0652962c5dace16ed170a932e3ce7e…
• lab52.io/blog/very-very-lazy-lazyscripters-scrip…
• twitter.com/h2jazi/status/1366759252757512194
• otx.alienvault.com/pulse/603693b42a32d06720efad59
• otx.alienvault.com/pulse/6228d0ba244cc5a2d6457b25
• virustotal.com/gui/ip-address/66.29.130.204/relations
• resources.malwarebytes.com/files/2021/02/LazyScripter.pdf
• virustotal.com/gui/ip-address/185.81.157.186/relations
• virustotal.com/gui/file/23ea10f4b1a73a4e8b13466fff8983…
• virustotal.com/gui/ip-address/147.182.192.241/relations