News and Analysis

The North Korean-linked APT group Lazarus has reportedly exploited Log4j vulnerabilities to deploy new remote access trojans (RATs) in a hacking campaign known as Operation Blacksmith. Research from Cisco Talos found three new DLang-based malware called NineRAT, DLRAT and EarlyRat. The group also employed the custom proxy tool HazyLoad in the operation. The trojans could receive commands from a Telegram-based channel.