Feed Mislabels Chinese Adware Bundle as Lazarus Group Intrusion
A threat feed tagged 49 files and 15 IPs as Lazarus Group activity with severity 100 and 85% confidence. CTX Team's review finds the artifacts actually describe TheWorld, a Chinese browser adware bundle, and its Qihoo/360 CDN infrastructure — with zero espionage techniques and no APT malware family present.
An indicator set flowing through commercial threat feeds under a severity rating of 100 and an 85 confidence score comes labeled, at the actor level, with one of the most storied names in offensive cyber operations: Lazarus Group. Cross-reference the actual artifacts against that label, however, and the picture that emerges is not an espionage intrusion set at all.
Members-only article
This story is members-only. Sign in to read the full body, indicators of compromise, and VirusTotal context.
Sign in to read