Operation Blacksmith: Lazarus targets organizations worldwide using novel Telegram-based malware written in DLang
Summary: Cisco Talos detailed Operation Blacksmith, in which the Lazarus group exploited CVE-2021-44228 (Log4Shell) on public-facing VMware Horizon servers and deployed a previously unknown DLang-based RAT called NineRAT that uses Telegram as its command-and-control channel. NineRAT was built around May 2022 and used as early as March 2023 against a South American agricultural organization, then around September 2023 against a European manufacturing entity, alongside two other DLang malware families, DLRAT and BottomLoader, and the proxy tool HazyLoad.
What's compelling: Lazarus runs NineRAT's command channel through Telegram, a legitimate service, so network and host controls tuned to block malicious infrastructure have little to flag - and the group keeps overlapping backdoors like HazyLoad in place so that finding one tool does not end its access.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Mentions
- CVE-2021-44228
- Related
- CVE-2021-44228: Apache Log4j2 Remote Code Execution Vulnerability Known Exploited Vulnerabilities · Dec 10, 2021Threat Source Newsletter (Dec. 16, 2021) Cyber Risks ·