By 
The Lazarus Group was found targeting the Log4Shell vulnerability (CVE-2021-44228) in a new series of attacks named “Operation Blacksmith.”
According to a new advisory published by Cisco Talos security researchers, the attacks leveraged the Log4Shell flaw in publicly facing VMWare Horizon servers for initial access.
This campaign consists of continued opportunistic targeting of enterprises around the world that publicly host and expose their vulnerable infrastructure to n-day vulnerability exploitation such as CVE-2021-44228.
Upon successful exploitation, Lazarus conducted extensive reconnaissance, employing various commands to gather system information, query event logs and conduct OS credential dumping.
The attackers deployed a custom-made implant named HazyLoad, acting as a proxy tool to establish direct access to the compromised system.
The Lazarus deviated from previous patterns by creating a local user account with administrative privileges instead of using unauthorized domain-level accounts.
The threat actors also shifted their tactics in the hands-on-keyboard phase by downloading and using credential dumping utilities, including ProcDump and MimiKatz.
The second phase of the operation revealed the deployment of a previously unknown Remote Access Trojan (RAT) dubbed “NineRAT.” The RAT utilized the Telegram-based C2 channel to receive preliminary commands for fingerprinting infected systems.
Additionally, the research identified a shift in Lazarus’ tactics, as NineRAT is written in DLang, indicating a departure from traditional frameworks. NineRAT also has the capability to uninstall itself from the system using a BAT file.
Cisco Talos also suggested that the data collected by Lazarus via NineRAT may be shared with other Advanced Persistent Threat (APT) groups, residing in a separate repository from initial access and implant deployment data.
