Our analysis of the backdoors used in the September 2018 attacks show that AuditCred.dll/ROptimizer.dll was similarly used:      FileTokenBroker.dll  (2017 attack) AuditCred.dll/Roptimizer.dll  (2018 attack)   Launch Method Service Service   Function Loader Component Loader Component   Working directory %Windows%\System32 %Windows%\System32   Loaded Component Path %Windows%\System32\en-US %Program Files%\Common Files\System\ado   Loaded Component Blending Blends with .mui files Blend with ActiveX data Object dll files    Table1: Similarities of the Loader components in both incidents Analysis of backdoors used in 2018 The Lazarus group used a series of backdoors in their 2018 attacks, employing a complicated technique that involves three major components:  AuditCred.dll/ROptimizer.dll (detected by Trend Micro as BKDR_BINLODR.ZNFJ-A) – loader DLL that is launched as a service Msadoz<n>.dll (detected by Trend Micro as BKDR64_BINLODR.ZNFJ-A) – encrypted backdoor n = number of characters in the loader dll’s filename Auditcred.dll.mui/rOptimizer.dll.mui (detected by Trend Micro as TROJ_BINLODRCONF.ZNFJ-A) – encrypted configuration file   Figure 1: Loading sequence of the modularized backdoor The loader DLL is installed as a service and uses different names (AuditCred and ROptimizer) on different machines