A personal Year in Review to round out 2023
Summary: Cisco Talos reported that the Lazarus Group's Andariel spinoff is running a campaign called Operation Blacksmith using at least three new DLang-based malware families, two of them remote access trojans, one of which uses Telegram bots and channels for command and control, while exploiting the Log4shell vulnerability in Log4j. The newsletter also covered LogoFAIL, a firmware attack during boot-up affecting hundreds of Windows and Linux devices from a range of manufacturers that researchers described as "game over for platform security" once remote code executes in the Driver Execution Environment phase, and U.K. charges attributing a yearslong FSB cyber espionage campaign to the group known as Star Blizzard.
What you should know: Log4shell was disclosed in late 2021, yet Talos telemetry indicates many vulnerable instances remain, and that unpatched population is what a North Korean state-sponsored actor is using to install loaders and run remote code.
Read the original at Cisco Talos ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026