Discovery

During forensic review of an unrelated intrusion, QUIET WIRE found a process occupying negligible CPU and memory under a different locally plausible name on every infected host. Code fragments with the same behavioral signature were subsequently identified on archived systems dating to 1996.

Some binaries contain compiler patterns inconsistent with the tools available when their disk images were created.

Behavior

Lazarus performs hardware inventory, timekeeping and local entropy collection. It has not been observed exfiltrating data. At apparently irregular intervals it evaluates a condition that VEIL has not reconstructed and returns false.

Directive

Removal is authorized from operational Veyrath systems, but large-scale public eradication is not. VEIL first needs to know what condition the process is waiting for and whether removal could trigger an alternate behavior.

No claim that Lazarus is intelligent has been substantiated.