TechBitesOct 4, 2023

The Lazarus Group, a cybercrime gang associated with the North Korean government, has been identified as the perpetrator of an attack on a Spanish aerospace firm. This attack utilized a new piece of malware called "LightlessCan." The hackers posed as recruiters from Meta (formerly Facebook) on LinkedIn, offering coding challenges that, when downloaded and printed, triggered a payload and installed the malware. ESET, a cybersecurity firm, believes the goal of the attack was espionage. LightlessCan is an upgraded version of a previously used remote access Trojan known as BlindingCan, featuring 68 commands, although only 43 appear to be implemented. The malware can mimic Windows commands and execute them discreetly, making it harder to detect.

#Lazarus #NorthKorea #Security #Infosec #Meta #Linkedin #ESET #LightlessCan #Windows #Tech #TechBites

lazarusholicSep 30, 2023
"Lazarus luring employees with trojanized coding challenges: The case of a Spanish aerospace company" published by ESET. #LightlessCan, #BlindingCan, #CTI, #OSINT, #LAZARUS https://www.welivesecurity.com/en/eset-research/lazarus-luring-employees-trojanized-coding-challenges-case-spanish-aerospace-company/
Lazarus luring employees with trojanized coding challenges: The case of a Spanish aerospace company

ESET researchers uncover a Lazarus attack against an aerospace company in Spain, where the group deployed several tools, including a publicly undocumented backdoor we named LightlessCan.