Hunting Lazarus Part III: The Infrastructure That Was Too Perfect

In investigating Lazarus Group’s “Contagious Interview” campaign, we discovered a second, highly advanced malware family and mapped nearly 20 perfectly hardened C2 servers—only to find so many anomalies that we now believe the infrastructure is likely a sophisticated honeypot or counter-intelligence operation designed to hunt the hunters.