Lazarus Group Exploits Log4j Bug with New RAT Malware

The Lazarus hacking group, believed to be based in North Korea, is exploiting the Log4j vulnerability to deploy new malware, including two remote access trojans (RATs) named NineRAT and DLRAT, as well as a malware downloader called BottomLoader. The use of the D programming language is unusual and likely chosen to evade detection. The campaign, dubbed "Operation Blacksmith," began in March 2023 and targets manufacturing, agricultural, and physical security companies globally. Lazarus' tactics and tools continue to evolve, demonstrating the group's adaptability. The malware allows for command and control communication via Telegram and supports various commands for information gathering, file exfiltration, and system manipulation. Cisco Talos researchers suspect that Lazarus may share collected data with other advanced persistent threat (APT) groups.