<\/p>\n
North Korean hacking collective Lazarus Group has been using a new type of \u201csophisticated\u201d malware as part of its fake employment scams \u2014 which researchers warn is far more challenging to detect than its predecessor.<\/p>\n
According<\/a> to a Sept. 29 post from ESET\u2019s senior malware researcher Peter K\u00e1lnai, while analyzing a recent fake job attack against a Spain-based aerospace firm, ESET researchers discovered a publicly undocumented backdoor named LightlessCan. <\/p>\n #ESET<\/a> researchers unveiled their findings about an attack by the North Korea-linked #APT<\/a> group #Lazarus<\/a> that took aim at an aerospace company in Spain.<\/p>\n \u25b6\ufe0f Find out more in a #WeekinSecurity<\/a> video with @TonyAtESET<\/a>. pic.twitter.com\/M94J200VQx<\/a><\/p>\n \u2014 ESET (@ESET) September 29, 2023<\/a><\/p><\/blockquote>\n The Lazarus Group\u2019s fake job scam typically involves tricking victims with a potential offer of employment at a well-known firm. The attackers would entice victims to download a malicious payload masqueraded as documents to do all sorts of damage. <\/p>\n However, K\u00e1lnai says the new LightlessCan payload is a \u201csignificant advancement\u201d compared to its predecessor BlindingCan.<\/p>\n \u201cLightlessCan mimics the functionalities of a wide range of native Windows commands, enabling discreet execution within the RAT itself instead of noisy console executions.\u201d<\/p>\n \u201cThis approach offers a significant advantage in terms of stealthiness, both in evading real-time monitoring solutions like EDRs, and postmortem digital forensic tools,\u201d he said. <\/p>\n \ufe0f\u200d\u2642\ufe0f Beware of fake LinkedIn recruiters! Find out how Lazarus group exploited a Spanish aerospace company via trojanized coding challenge. Dive into the details of their cyberespionage campaign in our latest #WeLiveSecurity<\/a> article. #ESET<\/a> #ProgressProtected<\/a><\/p>\n \u2014 ESET (@ESET) September 29, 2023<\/a><\/p><\/blockquote>\n The new payload also uses what the researcher calls \u201cexecution guardrails\u201d \u2014 ensuring that the payload can only be decrypted on the intended victim\u2019s machine, thereby avoiding unintended decryption by security researchers. <\/p>\n K\u00e1lnai said that one case that involved the new malware came from an attack on a Spanish aerospace firm when an employee received a message from a fake Meta recruiter named Steve Dawson in 2022.<\/p>\n Soon after, the hackers sent over the two simple coding challenges embedded with the malware.\u00a0<\/p>\n Cyberespionage was the main motivation behind Lazarus Group\u2019s attack<\/a> on the Spain-based aerospace firm, he added.<\/p>\n Related: <\/em><\/strong>3 steps crypto investors can take to avoid hacks by the Lazarus Group<\/em><\/strong><\/a><\/p>\n Since 2016, North Korean hackers have stolen an estimated $3.5 billion from cryptocurrency projects<\/a>, according to a Sept. 14 report by blockchain forensics firm Chainalysis.<\/p>\n In September 2022, cybersecurity firm SentinelOne warned of a fake job scam on LinkedIn, offering potential victims a job at Crypto.com as part of a campaign dubbed \u201cOperation Dream Job.”\u00a0<\/p>\n Meanwhile, the United Nations has beetrying to curtail North Korea\u2019s cybercrime tactics at the international level \u2014 as it is understood<\/a> North Korea is using the stolen funds to support its nuclear missile program.<\/p>\n\n
\n