Security

<![CDATA[<figure class="image"><img src="https://cimg.co/news/125853/332318/north-korean-hacker.jpeg" srcset="https://cimg.co/news/125853/332318/responsive-images/north-korean-hacker___media_library_original_1500_1000.jpeg 1500w, https://cimg.co/news/125853/332318/responsive-images/north-korean-hacker___media_library_original_1200_800.jpeg 1200w, https://cimg.co/news/125853/332318/responsive-images/north-korean-hacker___media_library_original_900_600.jpeg 900w, https://cimg.co/news/125853/332318/responsive-images/north-korean-hacker___media_library_original_720_480.jpeg 720w, https://cimg.co/news/125853/332318/responsive-images/north-korean-hacker___media_library_original_600_400.jpeg 600w, https://cimg.co/news/125853/332318/responsive-images/north-korean-hacker___media_library_original_300_200.jpeg 300w" width="1500" class="content-img" alt=""><figcaption>Source: Adobe / beebright</figcaption></figure>Cyber security experts at ESET have warned firms of the threat posed by the Lazarus Group&rsquo;s new malware &ldquo;LightlessCan&rdquo; saying it is more difficult to detect than previous versions.According to the firm, the malware is mostly deployed in employment scams luring users to install a malicious payload disguised as a job task or document related to the company.<figure class="media"><oembed url="https://twitter.com/eset/status/1707751628340695202?s=46&amp;t=sCvh3f3rMDfXyJcf1y1Eyg"></oembed></figure>In its <a href="https://www.welivesecurity.com/en/eset-research/lazarus-luring-employees-trojanized-coding-challenges-case-spanish-aerospace-company/">recent blog post on Sept 29</a>, the firm highlighted how the new malware works, its damage to the network systems, different execution chains leading to cyber espionage, etc.&nbsp;The Lazarus Group has been <a href="https://cryptonews.com/news/data-shows-north-korean-lazarus-group-accumulated-bitcoin-valued-over-40m.htm">linked to several crypto hacks</a> running into millions of dollars most notably the incident which saw over $40 million wiped from sports betting platform, Stake.com.&nbsp;The group was also linked to the Bitthumb, Nicehash incidents which recorded millions stolen alongside hacks on traditional companies like AstraZeneca, Sony, WannaCry, etc.<h2 id="heres-how-it-worked">Here&rsquo;s how it worked</h2>The cyber security experts explained that the hackers deliver payloads to the victim&rsquo;s network by utilizing a remote access Trojan, a far more sophisticated advancement than previous versions.&nbsp;<blockquote>&ldquo;LightlessCan mimics the functionalities of a wide range of native Windows commands, enabling discreet execution within the RAT itself instead of noisy console executions. This strategic shift enhances stealthiness, making detecting and analyzing the attacker&rsquo;s activities more challenging.&rdquo;</blockquote>LightlessCan also uses guardrails which serve as protective mechanisms for the payload during its execution, &ldquo;effectively preventing unauthorized decryption on unintended machines, such as those of security researchers,&rdquo; they added.Per the report, after initial access was gained through a social media hiring process, it used multiple encryptions,&nbsp; AES-128 and RC6 with a 256-bit key from its previous campaigns like the Amazon incident.&nbsp;<img src="https://cimg.co/news/125853/332317/figure-03-1.jpg" srcset="https://cimg.co/news/125853/332317/responsive-images/figure-03-1___media_library_original_1800_648.jpg 1800w, https://cimg.co/news/125853/332317/responsive-images/figure-03-1___media_library_original_1200_432.jpg 1200w, https://cimg.co/news/125853/332317/responsive-images/figure-03-1___media_library_original_900_324.jpg 900w, https://cimg.co/news/125853/332317/responsive-images/figure-03-1___media_library_original_720_259.jpg 720w, https://cimg.co/news/125853/332317/responsive-images/figure-03-1___media_library_original_600_216.jpg 600w, https://cimg.co/news/125853/332317/responsive-images/figure-03-1___media_library_original_300_108.jpg 300w" width="1800" class="content-img" alt="">The RATs deployment in the final stages work with droppers and loaders that are embedded with payload into the systems<blockquote>&ldquo;The most interesting payload used in this campaign is LightlessCan, a successor of the group&rsquo;s flagship HTTP(S) Lazarus RAT named BlindingCan. LightlessCan is a new complex RAT that has support for up to 68 distinct commands, indexed in a custom function table, but in the current version, 1.0, only 43 of those commands are implemented with some functionality.&rdquo;</blockquote>Finally, the security team called for renewed awareness of related scams to drastically reduce their occurrence to achieve digital safety.<h2 id="spains-aerospace-company-as-a-case-study">Spain&rsquo;s aerospace company as a case study</h2>The firm uncovered a hack by the Lazarus Group on a Spanish aerospace company leveraging the new LightlessCan model.&nbsp;The bad actors gained access to the company&rsquo;s networks last year after a series of targeted campaigns acting as a recruiter for the company.&nbsp;They contacted the victim through Linkedin and sent two coding tasks as part of the hiring strategy. The first task was a basic display of &ldquo;Hello, World!&rdquo; while the second involved printing of a Fibonacci sequence.
]]>

Lazarus Group’s New Malware is Harder To Detect, Cyber Security Firm Warns Crypto Firms

Table of Contents

Cryptonews.com

Other articles published on Oct 2, 2023

Solana (SOL) Jumps 15% in Unexpected Price Rally

3 Coins That Grew +20% In the Last Week of September

Enigmatic 'Satoshi Nakamoto' Social Media Account Resurfaces After Years of Silence

Is presale sensation Memeinator the meme cryptocurrency to never miss in 2023?

‘Is BlackRock Looking Into Cardano?’ Discusses Crypto Twitter

Bitcoin's 3.5% Price Surge to $28,074: Key Takeaways for October 2nd, 2023

Join our free newsletter for daily crypto updates!