lazarus-19day-layer.json

{
    "name": "Lazarus 19-Day A/B Test Campaign (2026)",
    "versions": {
        "attack": "16",
        "navigator": "5.1.0",
        "layer": "4.5"
    },
    "domain": "enterprise-attack",
    "description": "ATT&CK coverage map for Lazarus Group's three-wave GitHub phishing campaign targeting developers (March-April 2026). Red = observed in this campaign, Orange = broader Lazarus G0032 arsenal.",
    "filters": {
        "platforms": [
            "Linux",
            "macOS",
            "Windows",
            "Network",
            "PRE",
            "Containers",
            "Office 365",
            "SaaS",
            "IaaS",
            "Google Workspace",
            "Azure AD"
        ]
    },
    "sorting": 0,
    "layout": {
        "layout": "side",
        "aggregateFunction": "average",
        "showID": true,
        "showName": true,
        "showAggregateScores": false,
        "countUnscored": false
    },
    "hideDisabled": false,
    "techniques": [
        {
            "techniqueID": "T1566",
            "tactic": "initial-access",
            "color": "#ff0000",
            "comment": "Spearphishing Attachment - Fake security advisories distributed via email",
            "score": 100,
            "enabled": true,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1566.001",
            "tactic": "initial-access",
            "color": "#ff0000",
            "comment": "Spearphishing Attachment - Fake security advisories",
            "score": 100,
            "enabled": true
        },
        {
            "techniqueID": "T1566.002",
            "tactic": "initial-access",
            "color": "#ff0000",
            "comment": "Spearphishing Link - Google Share redirect URLs",
            "score": 100,
            "enabled": true
        },
        {
            "techniqueID": "T1566.003",
            "tactic": "initial-access",
            "color": "#ff0000",
            "comment": "Spearphishing via Service - GitHub notification abuse",
            "score": 100,
            "enabled": true
        },
        {
            "techniqueID": "T1204",
            "tactic": "execution",
            "color": "#ff0000",
            "comment": "User Execution - Malicious files and ClickFix commands",
            "score": 100,
            "enabled": true,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1204.002",
            "tactic": "execution",
            "color": "#ff0000",
            "comment": "User Execution: Malicious File - eleven.js, ClickFix terminal commands",
            "score": 100,
            "enabled": true
        },
        {
            "techniqueID": "T1059",
            "tactic": "execution",
            "color": "#ff0000",
            "comment": "Command and Scripting Interpreter - JavaScript-based payloads",
            "score": 100,
            "enabled": true,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1059.007",
            "tactic": "execution",
            "color": "#ff0000",
            "comment": "Command and Scripting Interpreter: JavaScript - eleven.js, init-workspace.js",
            "score": 100,
            "enabled": true
        },
        {
            "techniqueID": "T1027",
            "tactic": "defense-evasion",
            "color": "#ff0000",
            "comment": "Obfuscated Files or Information - Multiple obfuscation layers observed",
            "score": 100,
            "enabled": true,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1027.009",
            "tactic": "defense-evasion",
            "color": "#ff0000",
            "comment": "Obfuscated Files: Embedded Payloads - eleven.js obfuscation",
            "score": 100,
            "enabled": true
        },
        {
            "techniqueID": "T1027.013",
            "tactic": "defense-evasion",
            "color": "#ff0000",
            "comment": "Obfuscated Files: Encrypted/Encoded File - XOR encryption, Base85 layers",
            "score": 100,
            "enabled": true
        },
        {
            "techniqueID": "T1036",
            "tactic": "defense-evasion",
            "color": "#ff0000",
            "comment": "Masquerading - Fake CVE advisories and fake Uniswap sites",
            "score": 100,
            "enabled": true,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1036.005",
            "tactic": "defense-evasion",
            "color": "#ff0000",
            "comment": "Masquerading: Match Legitimate Name or Location - Fake CVE, fake Uniswap",
            "score": 100,
            "enabled": true
        },
        {
            "techniqueID": "T1056",
            "tactic": "collection",
            "color": "#ff0000",
            "comment": "Input Capture - Wallet credential capture via keylogging",
            "score": 100,
            "enabled": true,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056",
            "tactic": "credential-access",
            "color": "#ff0000",
            "comment": "Input Capture - Wallet credential capture via keylogging",
            "score": 100,
            "enabled": true,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1056.001",
            "tactic": "collection",
            "color": "#ff0000",
            "comment": "Input Capture: Keylogging - Wallet credential capture",
            "score": 100,
            "enabled": true
        },
        {
            "techniqueID": "T1056.001",
            "tactic": "credential-access",
            "color": "#ff0000",
            "comment": "Input Capture: Keylogging - Wallet credential capture",
            "score": 100,
            "enabled": true
        },
        {
            "techniqueID": "T1555",
            "tactic": "credential-access",
            "color": "#ff0000",
            "comment": "Credentials from Password Stores - Browser and wallet credential targeting",
            "score": 100,
            "enabled": true,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1555.003",
            "tactic": "credential-access",
            "color": "#ff0000",
            "comment": "Credentials from Web Browsers - Chrome password extraction",
            "score": 100,
            "enabled": true
        },
        {
            "techniqueID": "T1573",
            "tactic": "command-and-control",
            "color": "#ff0000",
            "comment": "Encrypted Channel - XOR-based symmetric encryption for C2",
            "score": 100,
            "enabled": true,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1573.001",
            "tactic": "command-and-control",
            "color": "#ff0000",
            "comment": "Encrypted Channel: Symmetric Cryptography - XOR keys for C2 comms",
            "score": 100,
            "enabled": true
        },
        {
            "techniqueID": "T1102",
            "tactic": "command-and-control",
            "color": "#ff0000",
            "comment": "Web Service - Pastebin used as dead drop resolver",
            "score": 100,
            "enabled": true,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1102.001",
            "tactic": "command-and-control",
            "color": "#ff0000",
            "comment": "Web Service: Dead Drop Resolver - Pastebin dead drops",
            "score": 100,
            "enabled": true
        },
        {
            "techniqueID": "T1048",
            "tactic": "exfiltration",
            "color": "#ff0000",
            "comment": "Exfiltration Over Alternative Protocol - FTP-based exfiltration",
            "score": 100,
            "enabled": true,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1048.003",
            "tactic": "exfiltration",
            "color": "#ff0000",
            "comment": "Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 Protocol - FTP exfiltration",
            "score": 100,
            "enabled": true
        },
        {
            "techniqueID": "T1547",
            "tactic": "persistence",
            "color": "#ff0000",
            "comment": "Boot or Logon Autostart Execution - Registry Run keys and Startup folder",
            "score": 100,
            "enabled": true,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547",
            "tactic": "privilege-escalation",
            "color": "#ff0000",
            "comment": "Boot or Logon Autostart Execution - Registry Run keys and Startup folder",
            "score": 100,
            "enabled": true,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1547.001",
            "tactic": "persistence",
            "color": "#ff0000",
            "comment": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder - Registry Run keys, Startup folder",
            "score": 100,
            "enabled": true
        },
        {
            "techniqueID": "T1547.001",
            "tactic": "privilege-escalation",
            "color": "#ff0000",
            "comment": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder - Registry Run keys, Startup folder",
            "score": 100,
            "enabled": true
        },
        {
            "techniqueID": "T1053",
            "tactic": "execution",
            "color": "#ff0000",
            "comment": "Scheduled Task/Job - NodeUpdate scheduled task for persistence",
            "score": 100,
            "enabled": true,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053",
            "tactic": "persistence",
            "color": "#ff0000",
            "comment": "Scheduled Task/Job - NodeUpdate scheduled task for persistence",
            "score": 100,
            "enabled": true,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053",
            "tactic": "privilege-escalation",
            "color": "#ff0000",
            "comment": "Scheduled Task/Job - NodeUpdate scheduled task for persistence",
            "score": 100,
            "enabled": true,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1053.005",
            "tactic": "execution",
            "color": "#ff0000",
            "comment": "Scheduled Task/Job: Scheduled Task - NodeUpdate task",
            "score": 100,
            "enabled": true
        },
        {
            "techniqueID": "T1053.005",
            "tactic": "persistence",
            "color": "#ff0000",
            "comment": "Scheduled Task/Job: Scheduled Task - NodeUpdate task",
            "score": 100,
            "enabled": true
        },
        {
            "techniqueID": "T1053.005",
            "tactic": "privilege-escalation",
            "color": "#ff0000",
            "comment": "Scheduled Task/Job: Scheduled Task - NodeUpdate task",
            "score": 100,
            "enabled": true
        },
        {
            "techniqueID": "T1588",
            "tactic": "resource-development",
            "color": "#ff0000",
            "comment": "Obtain Capabilities - SSL certificates acquired for C2 domains",
            "score": 100,
            "enabled": true,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1588.004",
            "tactic": "resource-development",
            "color": "#ff0000",
            "comment": "Obtain Capabilities: Digital Certificates - SSL certs for C2 domains",
            "score": 100,
            "enabled": true
        },
        {
            "techniqueID": "T1587",
            "tactic": "resource-development",
            "color": "#ff0000",
            "comment": "Develop Capabilities - Custom malware development",
            "score": 100,
            "enabled": true,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1587.001",
            "tactic": "resource-development",
            "color": "#ff0000",
            "comment": "Develop Capabilities: Malware - GolangGhost, PylangGhost, StoatWaffle",
            "score": 100,
            "enabled": true
        },
        {
            "techniqueID": "T1119",
            "tactic": "collection",
            "color": "#ff0000",
            "comment": "Automated Collection - Workspace telemetry collection",
            "score": 100,
            "enabled": true
        },
        {
            "techniqueID": "T1041",
            "tactic": "exfiltration",
            "color": "#ff0000",
            "comment": "Exfiltration Over C2 Channel - Wallet data exfiltrated to watery-compost.today",
            "score": 100,
            "enabled": true
        },
        {
            "techniqueID": "T1047",
            "tactic": "execution",
            "color": "#ff6600",
            "comment": "Windows Management Instrumentation - Broader Lazarus G0032 arsenal",
            "score": 50,
            "enabled": true
        },
        {
            "techniqueID": "T1033",
            "tactic": "discovery",
            "color": "#ff6600",
            "comment": "System Owner/User Discovery - Broader Lazarus G0032 arsenal",
            "score": 50,
            "enabled": true
        },
        {
            "techniqueID": "T1218",
            "tactic": "defense-evasion",
            "color": "#ff6600",
            "comment": "System Binary Proxy Execution - Broader Lazarus G0032 arsenal",
            "score": 50,
            "enabled": true,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1218.011",
            "tactic": "defense-evasion",
            "color": "#ff6600",
            "comment": "System Binary Proxy Execution: Rundll32 - Broader Lazarus G0032 arsenal",
            "score": 50,
            "enabled": true
        },
        {
            "techniqueID": "T1132",
            "tactic": "command-and-control",
            "color": "#ff6600",
            "comment": "Data Encoding - Broader Lazarus G0032 arsenal",
            "score": 50,
            "enabled": true,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1132.001",
            "tactic": "command-and-control",
            "color": "#ff6600",
            "comment": "Data Encoding: Standard Encoding - Broader Lazarus G0032 arsenal",
            "score": 50,
            "enabled": true
        },
        {
            "techniqueID": "T1561",
            "tactic": "impact",
            "color": "#ff6600",
            "comment": "Disk Wipe - Broader Lazarus G0032 arsenal",
            "score": 50,
            "enabled": true,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1561.002",
            "tactic": "impact",
            "color": "#ff6600",
            "comment": "Disk Wipe: Disk Structure Wipe - Broader Lazarus G0032 arsenal",
            "score": 50,
            "enabled": true
        },
        {
            "techniqueID": "T1560",
            "tactic": "collection",
            "color": "#ff6600",
            "comment": "Archive Collected Data - Broader Lazarus G0032 arsenal",
            "score": 50,
            "enabled": true,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1560.003",
            "tactic": "collection",
            "color": "#ff6600",
            "comment": "Archive Collected Data: Archive via Custom Method - Broader Lazarus G0032 arsenal",
            "score": 50,
            "enabled": true
        },
        {
            "techniqueID": "T1542",
            "tactic": "persistence",
            "color": "#ff6600",
            "comment": "Pre-OS Boot - Broader Lazarus G0032 arsenal",
            "score": 50,
            "enabled": true,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542",
            "tactic": "defense-evasion",
            "color": "#ff6600",
            "comment": "Pre-OS Boot - Broader Lazarus G0032 arsenal",
            "score": 50,
            "enabled": true,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1542.003",
            "tactic": "persistence",
            "color": "#ff6600",
            "comment": "Pre-OS Boot: Bootkit - Broader Lazarus G0032 arsenal",
            "score": 50,
            "enabled": true
        },
        {
            "techniqueID": "T1542.003",
            "tactic": "defense-evasion",
            "color": "#ff6600",
            "comment": "Pre-OS Boot: Bootkit - Broader Lazarus G0032 arsenal",
            "score": 50,
            "enabled": true
        },
        {
            "techniqueID": "T1074",
            "tactic": "collection",
            "color": "#ff6600",
            "comment": "Data Staged - Broader Lazarus G0032 arsenal",
            "score": 50,
            "enabled": true,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1074.001",
            "tactic": "collection",
            "color": "#ff6600",
            "comment": "Data Staged: Local Data Staging - Broader Lazarus G0032 arsenal",
            "score": 50,
            "enabled": true
        },
        {
            "techniqueID": "T1489",
            "tactic": "impact",
            "color": "#ff6600",
            "comment": "Service Stop - Broader Lazarus G0032 arsenal",
            "score": 50,
            "enabled": true
        },
        {
            "techniqueID": "T1543",
            "tactic": "persistence",
            "color": "#ff6600",
            "comment": "Create or Modify System Process - Broader Lazarus G0032 arsenal",
            "score": 50,
            "enabled": true,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543",
            "tactic": "privilege-escalation",
            "color": "#ff6600",
            "comment": "Create or Modify System Process - Broader Lazarus G0032 arsenal",
            "score": 50,
            "enabled": true,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1543.003",
            "tactic": "persistence",
            "color": "#ff6600",
            "comment": "Create or Modify System Process: Windows Service - Broader Lazarus G0032 arsenal",
            "score": 50,
            "enabled": true
        },
        {
            "techniqueID": "T1543.003",
            "tactic": "privilege-escalation",
            "color": "#ff6600",
            "comment": "Create or Modify System Process: Windows Service - Broader Lazarus G0032 arsenal",
            "score": 50,
            "enabled": true
        },
        {
            "techniqueID": "T1021",
            "tactic": "lateral-movement",
            "color": "#ff6600",
            "comment": "Remote Services - Broader Lazarus G0032 arsenal",
            "score": 50,
            "enabled": true,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1021.004",
            "tactic": "lateral-movement",
            "color": "#ff6600",
            "comment": "Remote Services: SSH - Broader Lazarus G0032 arsenal",
            "score": 50,
            "enabled": true
        },
        {
            "techniqueID": "T1574",
            "tactic": "persistence",
            "color": "#ff6600",
            "comment": "Hijack Execution Flow - Broader Lazarus G0032 arsenal",
            "score": 50,
            "enabled": true,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574",
            "tactic": "privilege-escalation",
            "color": "#ff6600",
            "comment": "Hijack Execution Flow - Broader Lazarus G0032 arsenal",
            "score": 50,
            "enabled": true,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574",
            "tactic": "defense-evasion",
            "color": "#ff6600",
            "comment": "Hijack Execution Flow - Broader Lazarus G0032 arsenal",
            "score": 50,
            "enabled": true,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1574.001",
            "tactic": "persistence",
            "color": "#ff6600",
            "comment": "Hijack Execution Flow: DLL Search Order Hijacking - Broader Lazarus G0032 arsenal",
            "score": 50,
            "enabled": true
        },
        {
            "techniqueID": "T1574.001",
            "tactic": "privilege-escalation",
            "color": "#ff6600",
            "comment": "Hijack Execution Flow: DLL Search Order Hijacking - Broader Lazarus G0032 arsenal",
            "score": 50,
            "enabled": true
        },
        {
            "techniqueID": "T1574.001",
            "tactic": "defense-evasion",
            "color": "#ff6600",
            "comment": "Hijack Execution Flow: DLL Search Order Hijacking - Broader Lazarus G0032 arsenal",
            "score": 50,
            "enabled": true
        },
        {
            "techniqueID": "T1553",
            "tactic": "defense-evasion",
            "color": "#ff6600",
            "comment": "Subvert Trust Controls - Broader Lazarus G0032 arsenal",
            "score": 50,
            "enabled": true,
            "showSubtechniques": true
        },
        {
            "techniqueID": "T1553.002",
            "tactic": "defense-evasion",
            "color": "#ff6600",
            "comment": "Subvert Trust Controls: Code Signing - Broader Lazarus G0032 arsenal",
            "score": 50,
            "enabled": true
        }
    ],
    "gradient": {
        "colors": [
            "#ffffff",
            "#ff6600",
            "#ff0000"
        ],
        "minValue": 0,
        "maxValue": 100
    },
    "legendItems": [
        {
            "label": "Observed in 19-Day Campaign",
            "color": "#ff0000"
        },
        {
            "label": "Broader Lazarus G0032 Arsenal",
            "color": "#ff6600"
        },
        {
            "label": "Not Observed",
            "color": "#ffffff"
        }
    ],
    "metadata": [],
    "links": [],
    "showTacticRowBackground": true,
    "tacticRowBackground": "#205b8f",
    "selectTechniquesAcrossTactics": false,
    "selectSubtechniquesWithParent": false,
    "selectVisibleTechniques": false
}