NineRAT Malware Targets Systems Uses Tactics of Lazarus Hacker Group

Cisco Talos recently uncovered a new cyber campaign orchestrated by the Lazarus Group, named "Operation Blacksmith." This operation employs three novel DLang-based malware families, with two identified as remote access trojans (RATs). Notably, one of these RATs utilizes Telegram bots and channels as a means of command and control (C2) communications, earning the moniker "NineRAT," while the non-Telegram-based RAT is labeled "DLRAT." Additionally, a DLang-based downloader known as "BottomLoader" was identified in the operation.

This discovery marks a significant shift in the tactics employed by the Lazarus Group, a North Korean APT (Advanced Persistent Threat) group. Over the past 18 months, Cisco Talos has disclosed three distinct RATs developed using unconventional technologies such as QtFramework, PowerBasic, and the most recent addition, DLang.

Notably, parallels were observed between Lazarus' Operation Blacksmith and the tactics, techniques, and procedures (TTPs) associated with the North Korean state-sponsored group Onyx Sleet, also recognized as the Andariel APT group. Andariel is widely considered a sub-group under the Lazarus umbrella, with this campaign demonstrating opportunistic targeting of global enterprises that expose vulnerable infrastructure to n-day vulnerability exploitation, including the well-known CVE-2021-44228 (Log4j). Lazarus specifically targeted industries such as manufacturing, agriculture, and physical security.

Operation Blacksmith involved the exploitation of Log4j and introduced a previously unknown DLang-based RAT, NineRAT, which utilized Telegram for C2 communication. NineRAT was initially constructed around May 2022 and was first employed in the campaign approximately a year later, targeting a South American agricultural organization in March 2023 and a European manufacturing entity in September 2023.

Analyses by Cisco Talos revealed overlap with malicious attacks disclosed by Microsoft in October 2023, attributed to Onyx Sleet. This aligns with the broader understanding that the Lazarus APT operates as an umbrella organization encompassing various sub-groups, each pursuing different objectives related to North Korea's defense, politics, national security, and research and development.

Computer users affected by the NineRAT Malware should take action in use of an anti-malware tool to not only prevent future attacks but to fully eliminate the threat.