North Korea’s Ambitious Cyber Espionage: Unveiling the Complex Backdoor at an Aerospace Org

The Evolving Threat: North Korea’s Lazarus Group

Introduction

North Korea’s state-sponsored hacking group, Lazarus, has once again demonstrated its ability to adapt and evolve its cyber-espionage tactics. Researchers from ESET have discovered a new backdoor malware, named “LightlessCan,” which is believed to be based on the source code of Lazarus Group’s flagship BlindingCan remote access Trojan (RAT). This sophisticated malware was first detected in a successful cyber attack on a Spanish aerospace company. The emergence of LightlessCan highlights the ongoing threat posed by Lazarus and raises concerns about the group’s evolving capabilities and the potential risks it poses to organizations worldwide.

The Pernicious Lazarus Group

The Lazarus Group has gained notoriety for its malicious activities over the years. Since its devastating attack on Sony Pictures in 2014, this North Korean state-backed threat group has established itself as one of the most persistent and pernicious advanced persistent threat (APT) groups in operation today. The group has targeted various sectors, including financial institutions, defense contractors, government agencies, healthcare organizations, and energy firms, to steal sensitive information, execute cryptocurrency heists, and carry out supply chain attacks.

Spear-Phishing as a Gateway

ESET’s analysis of the Spanish aerospace company attack revealed that Lazarus gained initial access through a targeted spear-phishing campaign. Posing as a recruiter for Facebook parent company Meta, the threat actor contacted specific employees at the aerospace firm via LinkedIn Messaging. This social engineering technique deceived an employee into responding to the initial message and subsequently receiving two coding challenges. These challenges, hosted on a third-party cloud storage platform, contained malicious executables disguised as coding exercises. When the unsuspecting employee attempted to solve the challenge, additional payloads were surreptitiously downloaded onto their system.

An Evolving Threat Landscape

The first payload deployed by Lazarus was an HTTPS downloader known as NickelLoader. This tool allowed the threat actors to execute any program of their choice in the compromised system’s memory. In this instance, Lazarus used NickelLoader to deliver two RATs: a simplified version of BlindingCan (miniBlindingCan) and the newly discovered LightlessCan backdoor. While miniBlindingCan collects system information and executes commands from the command-and-control (C2) server, LightlessCan represents a more advanced and significant threat to targeted organizations.

The Stealth of LightlessCan

According to Peter Kálnai, a researcher at ESET, LightlessCan is designed to mitigate traces of malicious activity on compromised systems, making it challenging for real-time monitoring controls and forensic tools to detect its presence. The malware integrates support for numerous native Windows commands, mimicking legitimate system operations. This stealthy approach, along with the utilization of encrypted payloads specific to the compromised machine, enhances the malware’s ability to evade detection by endpoint detection and response (EDR) solutions and circumvent postmortem digital forensic analysis.

An Ongoing Development

While LightlessCan currently supports 68 distinct commands, only 43 of them are functional at present. The remaining commands serve as placeholders, suggesting ongoing development and future enhancements by the Lazarus Group. This continuous evolution makes it even more challenging for cybersecurity professionals to effectively defend against the group’s malicious activities.

The Larger Context and Recommendations

The discovery of the LightlessCan backdoor highlights the persistent and relentless nature of state-sponsored cyber threats. Governments and organizations must remain vigilant in fortifying their cybersecurity defenses to counter evolving threats like those posed by the Lazarus Group.

A Multi-Faceted Approach

Organizations should employ a multi-faceted approach to cybersecurity, including robust email and network security measures, comprehensive employee training programs, and advanced threat detection systems. Given that spear-phishing served as the initial access point for the Lazarus Group’s attack, it is essential to educate employees about the risks of social engineering and how to identify and report suspicious messages.

Continuous Monitoring and Analysis

Real-time monitoring controls and endpoint detection and response (EDR) solutions play a vital role in detecting and mitigating cyber threats. Organizations should prioritize the deployment of these technologies to promptly identify and respond to any unauthorized activities within their networks. Additionally, postmortem digital forensic tools can provide invaluable insights into the nature of an attack, helping organizations improve their defenses and recover from any potential breaches.

International Collaboration and Diplomacy

The cyberthreat landscape transcends borders, making international collaboration and diplomacy crucial in combatting state-sponsored hacking groups. Governments and intelligence agencies should work together to share threat intelligence, thereby enhancing the collective ability to detect and neutralize malicious actors. Diplomatic efforts should be pursued to establish norms and rules governing cyberspace, fostering a more secure and resilient digital environment.

An Ongoing Battle

The emergence of LightlessCan signifies that threat actors like the Lazarus Group are constantly advancing their tactics and techniques. As such, organizations must proactively evolve their cybersecurity strategies to stay one step ahead. By adopting a comprehensive approach, prioritizing education and training, and investing in the latest security technologies, organizations can better protect themselves from sophisticated cyber threats and mitigate potential risks associated with state-sponsored hacking groups.