North Korean hackers are targeting aerospace - Lazarus Group tricks employees into installing malware themselves

News
By published

Notorious Lazarus group pioneering a new type of cyberattack

cyber, attack, hacked word on screen binary code display, hacker
(Image credit: Shutterstock/supimol kumying)

A famous cybercriminal group known for its links to the North Korean regime has continued its spree of recent attacks by targeting an unnamed Spanish aerospace company.

Lazarus, notably known for its 2017 WannaCry attack, have been adapting and evolving their methods of attack.

Article continues below

Malware disguised as a coding challenge

Employees were approached by what appeared to be recruiters from Meta through LinkedIn, who were looking for individuals to complete a coding challenge to demonstrate their capabilities. 

Rather than launching the coding challenge, the files instead installed malware most likely intended to steal aerospace data, according to ESET researchers. Aerospace data has long been a target of North Korean hackers and theory behind this is its use in North Korean nuclear missile programmes. Part of the malware included Lazarus’ latest backdoor software, LightlessCan, which is built upon the group's work with their previous payload, BlindingCan.

“The most worrying aspect of the attack is the new type of payload, LightlessCan, a complex and possibly evolving tool that exhibits a high level of sophistication in its design and operation, representing a significant advancement in malicious capabilities compared to its predecessor, BlindingCan.” the ESET reporter stated.

“The attackers can now significantly limit the execution traces of their favorite Windows command line programs that are heavily used in their post-compromise activity. This maneuver has far-reaching implications, impacting the effectiveness of both real-time monitoring solutions and of post-mortem digital forensic tools.”

Via The Register

More from TechRadar Pro

Benedict Collins
Benedict Collins
Senior Writer, Security

Benedict is a Senior Security Writer at TechRadar Pro, where he has specialized in covering the intersection of geopolitics, cyber-warfare, and business security.

Benedict provides detailed analysis on state-sponsored threat actors, APT groups, and the protection of critical national infrastructure, with his reporting bridging the gap between technical threat intelligence and B2B security strategy.

Benedict holds an MA (Distinction) in Security, Intelligence, and Diplomacy from the University of Buckingham Centre for Security and Intelligence Studies (BUCSIS), with his specialization providing him with a robust academic framework for deconstructing complex international conflicts and intelligence operations, and the ability to translate intricate security data into actionable insights.