North Korean state-sponsored hacker group Lazarus targeted companies in manufacturing, agriculture and physical security sectors with new malware families as part of operation 'Blacksmith' since March 2023 · 01.03.2023
The North Korean state-sponsored hacker group Lazarus exploited the Log4Shell vulnerability (CVE-2021-44228) as part of a campaign dubbed 'Blacksmith', which opportunistically targeted manufacturing, agricultural and physical security companies worldwide. Talos Intelligence observed Lazarus proceeding to install the previously unknown DLang-based RAT from the NineRAT malware family. Initial targeting activities linked to the campaign trace back to March 2023 and surfaced again in September 2023. The campaign shares overlaps with malicious activity Microsoft reported in October 2023 and attributed to Onyx Sleet (previously tracked as PLUTIONIUM), which is also known as Andariel and suspected to operate as a subgroup of Lazarus.
Targeting of manufacturing and real-estate sectors in India and telecommunications companies in Bulgaria and Pakistan · Apr 2023
A Lazarus Group campaign, active from early 2020 until January 2023, leveraged a backdoored UltraVNC client against manufacturing and real-estate sectors in India and telecommunications companies in Pakistan and Bulgaria. The goal of the operation, whose scope extends beyond Bulgaria, India, and Pakistan, appears to be intelligence collection.
Operation Blacksmith: Lazarus targets organizations worldwide using novel Telegram-based malware written in DLang · 2023-12-11T13:50:59.000Z
During our analysis, Talos found some overlap with the malicious attacks disclosed by Microsoft in October 2023 attributing the activity to Onyx Sleet, also known as PLUTIONIUM or Andariel.
Manufacturing, agricultural, and physical security companies worldwide. · 11/12/2023
Researchers from Cisco Talos discover a new campaign conducted by the Lazarus Group called “Operation Blacksmith,” exploiting the CVE-2021-44228 Log4J vulnerability, and employing at least three new DLang-based malware families: NineRAT, DLRAT, and BottomLoader. [Date Occurred: Since at least March 2023; Date Discovered: -]
Operation Blacksmith: Lazarus targets organizations worldwide using novel Telegram-based malware written in DLang · December
Annex 59: List of DPRK Cyberthreat actors’ malicious activities monitored by the Panel in 2023 (row 75 of 75, PDF p. 332). DPRK cyber actor: Lazarus; Report Name: Operation Blacksmith: Lazarus targets organizations worldwide using novel Telegram-based malware written in DLang; Case Summary: The Lazarus Group has employed at least three new DLang-based malware families, including two RATs, one of which uses Telegram bots and channels for C2. The Lazarus Group used these malware families in 2023 to attack global enterprises, such as manufacturing, agricultural and physical security companies, continuing to target infrastructure through n-day exploits such as Log4j on publicly facing VMWare Horizon servers.; Publication Month: December
New DLang-based malware families (Telegram-based C2) used against manufacturing, agricultural and physical security companies · 2023
Para 142 (a): “The Lazarus Group has employed at least three new DLang-based malware families, including two RATs, one of which used Telegram bots and channels for command and control. The Lazarus Group has reportedly used these malware families to attack global enterprises such as manufacturing, agricultural and physical security companies.”
Operation Blacksmith (DLang-based malware families) · Q4 2023 (from title: APT QUARTERLY HIGHLIGHTS : Q4 - 2023)
Lazarus Group’s Operation Blacksmith revealed the use of new DLang-based malware families targeting European manufacturing entities, while Operation Dream Magic exploited vulnerabilities in MagicLine4NX software.