The North Korean-backed Lazarus group have shifted away from their usual tactics and have begun targeting IT vendors throughout the world. The Lazarus group is a military-centric hacking group which has been active since 2009. The group mainly targets high-level organizations such as Sony Entertainment/Films and top-tier banks. The group became well-known during the WannaCry ransomware attacks in 2017, which targeted companies on a global scale. By utilizing a variant of the “BLINDINGCAN” backdoor, these actors have the capabilities to infiltrate a network, exfiltrate data, evade detection, tamper with system timestamps, and replicate itself throughout the network. Delivered by the “COPPERHEDGE” remote access trojan (RAT), these malicious programs were seen targeting entities in Latvia and South Korea. Alongside Lazarus, Russian threat groups have also been seen actively targeting IT vendors (as reported last week). CTAPT is continuing to monitor the rising attacks against IT supply chains and will provide more updates when further information becomes available.