Introduction Today, Google’s Threat Analysis Group (TAG) published a blogpost explaining that several security researchers have been targeted by (allegedly) North Korea. Since the operation seems to be targeting the curiosity of security researchers as an enabler for a successful operation, we dubbed this operation PANDORABOX.
No explanation was given on the attribution but Costin Raiu posted a screenshot from the Kaspersky Threat Attribution Engine which highlights code sharing between Manuscrypt (Lazarus).