{"id":7293,"date":"2023-02-02T16:16:00","date_gmt":"2023-02-02T16:16:00","guid":{"rendered":"https:\/\/www.withsecure.com\/?post_type=lab_item&p=7293"},"modified":"2026-05-22T12:52:22","modified_gmt":"2026-05-22T11:52:22","slug":"no-pineapple-dprk-targeting-of-medical-research-and-technology-sector","status":"publish","type":"lab_item","link":"https:\/\/www.withsecure.com\/en\/resources-hub\/w-labs\/no-pineapple-dprk-targeting-of-medical-research-and-technology-sector\/","title":{"rendered":"No Pineapple"},"content":{"rendered":"\n
\n

\n No Pineapple! \u2013DPRK Targeting of Medical Research and Technology Sector<\/span><\/h1> <\/div>\n<\/section>\n\n\n\n
\n
\n
\n \"\" <\/figure>\n <\/div>\n <\/div>\n<\/section>\n\n\n\n
\n
\n
\n

\n Authors <\/p>\n \n

\n
\n
\n \n \n <\/path>\n <\/path>\n <\/svg>\n <\/span>\n <\/div>\n
\n

Sami Ruohonen<\/h3>\n \n \n <\/div>\n\n<\/div>\n\n
\n
\n \n \n <\/path>\n <\/path>\n <\/svg>\n <\/span>\n <\/div>\n
\n

Stephen Robinson<\/h3>\n \n \n <\/div>\n\n<\/div>\n\n <\/div>\n\n <\/div>\n
\n

\n Download Report <\/p>\n \n

\n
\n \n Click here
\n
\n

Summary<\/h2>\n

During Q4 2022, WithSecure\u2122 detected and responded to a cyber attack conducted by a threat actor that WithSecure\u2122 have attributed with high confidence to an intrusion set referred to as Lazarus Group. Attribution with high confidence was based off of overlapping techniques tactics and procedures as well as an operational security mistake by the threat actor. Amongst technical indications, the incident observed by WithSecure\u2122 also contains characteristics of recent campaigns attributed to Lazarus Group by other researchers.<\/p>\n

The campaign targeted public and private sector research organizations, the medical research and energy sector as well as their supply chain. The motivation of the campaign is assessed to be most likely for intelligence benefit. Previous reporting on similar campaigns highlights the targeting of technology with military implementations and WithSecure\u2122 assesses that this type of targeting continued through Q4 2022.<\/p>\n

WithSecure\u2122 Threat Intelligence has named this report \u2018No Pineapple\u2019 due to an error message in a backdoor which will append < No Pineapple! > in the event data when it exceeds segmented byte size.<\/p>\n

 <\/p>\n

Key Incident Points<\/h2>\n