Lazarus Group Data Theft

A Lazarus Group-attributed campaign targeting financial data has been detected in the collection phase. The attacker has compromised a service account with read access to the data warehouse and is systematically querying customer financial records. The Data Agent detected the anomalous query patterns and has been replacing real results with convincing synthetic data. The attacker has collected 2.3GB of fabricated records believing them to be genuine. Meanwhile, all genuine data access from the compromised account has been revoked.