The widely known and North Korea backed Lazarus threat group is in the news once again, this time targeting security researchers through a weaponized malware reverse engineering analysis platform. IDA Pro is a disassembler suite designed to display executables in a human-readable environment which allows for security researchers/analysts to navigate the inner workings of the file. The ESET security company stated, “based on the domain and trojanized application, we attribute this malware to known Lazarus activity, previously reported by Google’s Threat Analysis Group and Microsoft.” The threat group infected a pirated version of the software with malicious backdoors and remote access modules. Upon execution of the software, an infected binary connects to a malicious remote server to retrieve additional malicious payloads and installs them on the system for a variety of uses, such as keylogging, credential harvesting, and file exfiltration. The remote server is also tied to another North Korean threat campaign back in March, which was also aimed to target security professionals. CTAPT will continue to monitor the movements of these threat actors and will provide updates accordingly.