Lazarus Uses Telegram-Controlled DLang Malware in Operation Blacksmith
Summary
Cisco Talos details Lazarus’s Operation Blacksmith campaign, which exploited Log4Shell on exposed VMware Horizon servers and deployed three DLang malware families, including NineRAT, which uses Telegram for command and control.
Key points
- Talos observed attacks against manufacturing, agricultural, and physical security organizations, with activity linked to Lazarus and overlapping with Onyx Sleet/Andariel.
- The attackers exploited Log4Shell (CVE-2021-44228) on publicly exposed VMware Horizon servers for initial access.
- NineRAT is a DLang remote access trojan that uses Telegram bots and channels for commands, system information, and file transfers.
- DLRAT provides remote command execution and file upload/download capabilities; BottomLoader downloads and executes follow-on payloads such as HazyLoad.
- Attackers used HazyLoad for persistent proxy access, created a local administrator account, and harvested credentials using tools including ProcDump and Mimikatz.
- Talos published malware hashes and network indicators and described detection coverage through Cisco security products and Snort rules.
Article Details
- Attack Vectors
- Lazarus Group exploited CVE-2021-44228 (Log4Shell) on publicly exposed VMware Horizon servers to gain initial access.
- The operators conducted hands-on-keyboard reconnaissance and credential theft, including use of ProcDump and MimiKatz.
- NineRAT used Telegram bots and channels for command and control, command exchange, and file transfer.
- BottomLoader downloaded and executed follow-on payloads, including HazyLoad; DLRAT could download and deploy additional malware.
- The operators created a local account and added it to the Administrators group.
- Defensive Notes
- Apply protections against CVE-2021-44228 on publicly exposed infrastructure.
- Monitor for suspicious Telegram-based command-and-control and file-transfer activity.
- Detect unauthorized local account creation and addition to the Administrators group.
- Monitor for the described reconnaissance and credential-dumping activity, including ProcDump and MimiKatz use.
- Cisco recommends its security products and Snort Subscriber Rule Set for detecting or blocking activity described in the article.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | tech[.]micrsofts[.]com | Domain listed among network IOCs associated with Operation Blacksmith. |
| DOMAIN | tech[.]micrsofts[.]tech | Domain listed among network IOCs associated with Operation Blacksmith. |
| IPV4 | 155[.]94[.]208[.]209 | IP address listed among network IOCs associated with Operation Blacksmith. |
| IPV4 | 162[.]19[.]71[.]175 | IP address listed among network IOCs; the article gives a BottomLoader payload URL hosted on it. |
| IPV4 | 185[.]29[.]8[.]53 | IP address listed among network IOCs associated with Operation Blacksmith. |
| IPV4 | 201[.]77[.]179[.]66 | IP address listed among network IOCs and hosting multiple listed payload-related URLs. |
| IPV4 | 27[.]102[.]113[.]93 | IP address listed among network IOCs; the article shows it hosting a HazyLoad download. |
| SHA256 | 000752074544950ae9020a35ccd77de277f1cd5026b4b9559279dc3b86965eee | HazyLoad malware hash listed in the article's IOCs. |
| SHA256 | 0e416e3cc1673d8fc3e7b2469e491c005152b9328515ea9bbd7cf96f1d23a99f | BottomLoader malware hash listed in the article's IOCs. |
| SHA256 | 47e017b40d418374c0889e4d22aa48633b1d41b16b61b1f2897a39112a435d30 | NineRAT malware hash listed in the article's IOCs. |
| SHA256 | 534f5612954db99c86baa67ef51a3ad88bc21735bce7bb591afa8a4317c35433 | NineRAT malware hash listed in the article's IOCs. |
| SHA256 | 5b02fc3cfb5d74c09cab724b5b54c53a7c07e5766bffe5b1adf782c9e86a8541 | NineRAT malware hash listed in the article's IOCs. |
| SHA256 | 82d4a0fef550af4f01a07041c16d851f262d859a3352475c62630e2c16a21def | NineRAT malware hash listed in the article's IOCs. |
| SHA256 | 9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a | DLRAT malware hash listed in the article's IOCs. |
| SHA256 | ba8cd92cc059232203bcadee260ddbae273fc4c89b18424974955607476982c4 | NineRAT malware hash listed in the article's IOCs. |
| SHA256 | e615ea30dd37644526060689544c1a1d263b6bb77fe3084aa7883669c1fde12f | DLRAT malware hash listed in the article's IOCs. |
| SHA256 | f91188d23b14526676706a5c9ead05c1a91ea0b9d6ac902623bc565e1c200a59 | NineRAT malware hash listed in the article's IOCs. |
| URL | hxxp[:]//27[.]102[.]113[.]93/inet[.]txt | HazyLoad download URL listed as a network IOC. |
MITRE ATT&CK
T1003.005 · Cached Domain CredentialsThe operators queried the WDigest registry setting and changed UseLogonCredential; they also used credential-dumping utilities against LSASS.T1033 · System Owner/User DiscoveryThe operators listed local Administrators group members during reconnaissance.T1082 · System Information DiscoveryThe operators ran commands including whoami, systeminfo, ipconfig, and WMIC queries to collect system information.T1098 · Account ManipulationThe operators added the created local account to the Administrators group.T1112 · Modify RegistryThe operators used reg add to change the WDigest UseLogonCredential registry value.T1136.001 · Local AccountThe operators created the local account krtbgt on a compromised system.T1518 · Software DiscoveryThe operators queried installed security software and searched task lists for security-related processes.
CVE
People
Threat Actors
AndarielThe article identifies this as another name for Onyx Sleet and describes it as an APT sub-group under the Lazarus umbrella.Lazarus GroupConducted Operation Blacksmith and deployed NineRAT, DLRAT, BottomLoader, and HazyLoad.Onyx SleetThe article reports overlap with this group's TTPs and says it is also known as PLUTIONIUM and the Andariel APT group.PLUTIONIUMThe article identifies this as another name for Onyx Sleet.
Malware
BottomLoaderRAT as “NineRAT” and the non-Telegram-based RAT as “DLRAT.” We track the DLang-based downloader as “BottomLoader.”DLRAT(C2) communications. We track this Telegram-based RAT as “NineRAT” and the non-Telegram-based RAT as “DLRAT.” We track the DLang-based downloader as “BottomLoader.”MagicRATserver is “23wfow02rofw391ng23“, which is the same value that we found during our previous research into MagicRAT. In the case of MagicRAT, the value is encoded as an HTML post. But with DLRAT, it's being posted asNineRATchannels as a medium of command and control (C2) communications. We track this Telegram-based RAT as “NineRAT” and the non-Telegram-based RAT as “DLRAT.” We track the DLang-based downloader as “BottomLoader.”QuiteRATmalware being authored using non-traditional frameworks such as the Qt framework, including MagicRAT and QuiteRAT.
Vendors
CiscoCisco Talos recently discovered a new campaign conducted by the Lazarus Group we’re calling “Operation Blacksmith,” employing at least three new DLang-based malware families, two of which are remote access trojansMicrosoftDuring our analysis, Talos found some overlap with the malicious attacks disclosed by Microsoft in October 2023 attributing the activity to Onyx Sleet, also known as PLUTIONIUM or Andariel.
Products
Adaptive Security ApplianceCisco Secure Firewall (formerly Next-Generation Firewall and Firepower NGFW) appliances such as Threat Defense Virtual, Adaptive Security Appliance and Meraki MX can detect malicious activity associated with this threat.Cisco DuoCisco Duo provides multi-factor authentication for users to ensure only those authorized are accessing your network.Cisco Secure EmailCisco Secure Email (formerly Cisco Email Security) can block malicious emails sent by threat actors as part of their campaign. You can try Secure Email for free here.Cisco Secure EndpointCisco Secure Endpoint (formerly AMP for Endpoints) is ideally suited to prevent the execution of the malware detailed in this post. Try Secure Endpoint for free here.Cisco Secure FirewallCisco Secure Firewall (formerly Next-Generation Firewall and Firepower NGFW) appliances such as Threat Defense Virtual, Adaptive Security Appliance and Meraki MX can detect malicious activity associated with this threat.Cisco Secure Malware AnalyticsCisco Secure Malware Analytics (Threat Grid) identifies malicious binaries and builds protection into all Cisco Secure products.Cisco Secure Web ApplianceCisco Secure Web Appliance web scanning prevents access to malicious websites and detects malware used in these attacks.Log4jand expose their vulnerable infrastructure to n-day vulnerability exploitation such as CVE-2021-44228 (Log4j). We have observed Lazarus target manufacturing, agricultural and physical security companies.Meraki MXCisco Secure Firewall (formerly Next-Generation Firewall and Firepower NGFW) appliances such as Threat Defense Virtual, Adaptive Security Appliance and Meraki MX can detect malicious activity associated with this threat.SnortOpen-source Snort Subscriber Rule Set customers can stay up to date by downloading the latest rule pack available for purchase on Snort.org.TelegramOperation Blacksmith: Lazarus targets organizations worldwide using novel Telegram-based malware written in DLangThreat Defense VirtualCisco Secure Firewall (formerly Next-Generation Firewall and Firepower NGFW) appliances such as Threat Defense Virtual, Adaptive Security Appliance and Meraki MX can detect malicious activity associated with this threat.Umbrellaknown as the Andariel APT group. Andariel is widely considered to be an APT sub-group under the Lazarus umbrella. VMware Horizoninvolves the successful exploitation of CVE-2021-44228, also known as Log4Shell, on publicly facing VMWare Horizon servers, as a means of initial access to vulnerable public-facing servers. Preliminary reconnaissance
Tools
HazyLoadA common artifact in this campaign was “HazyLoad,” a custom-made proxy tool previously only seen in the Microsoft report. Talos found HazyLoad targeting a European firm and an American subsidiary of a South KoreanMimikatzThe hands-on-keyboard activity begins by downloading and using credential dumping utilities such as ProcDump and MimiKatz.ProcDumpThe hands-on-keyboard activity begins by downloading and using credential dumping utilities such as ProcDump and MimiKatz.
Countries
Industries
AgricultureLazarus Group’s, Operation Blacksmith compromised manufacturing, agriculture and physical security sectorsHealthcareKorean government interests. In some cases, Andariel has also conducted ransomware attacks against healthcare organizations.Manufacturingto n-day vulnerability exploitation such as CVE-2021-44228 (Log4j). We have observed Lazarus target manufacturing, agricultural and physical security companies.Physical security and surveillanceTalos found HazyLoad targeting a European firm and an American subsidiary of a South Korean physical security and surveillance company as early as May 2023.