Lazarus and the tale of three RATs
Summary: Cisco Talos observed North Korean state-sponsored Lazarus Group exploiting VMware vulnerabilities, including Log4j on exposed VMware Horizon servers, between February and July 2022 to deploy the custom implants VSingle and YamaBot plus a previously unknown implant it named MagicRAT. The campaign primarily targeted energy companies in Canada, the U.S. and Japan, with the likely goal of establishing long-term access for espionage, and Talos found command-and-control and payload-hosting infrastructure overlapping with CISA's June advisory on VMware Horizon compromises.
Key Takeaway: Lazarus reached energy companies in three countries through public-facing VMware Horizon servers, and the shared infrastructure with CISA's June advisory means the same access path was already flagged to defenders before these intrusions were detailed.
Read the original at Cisco Talos ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026