Operation Blacksmith: Lazarus targets organizations worldwide using novel Telegram-based malware written in DLang

• Cisco Talos recently discovered a new campaign conducted by the Lazarus Group we’re calling “Operation Blacksmith,” employing at least three new DLang-based malware families, two of which are remote access trojans (RATs), where one of these uses Telegram bots and channels as a medium of command and control (C2) communications. We track this Telegram-based RAT as “NineRAT” and the non-Telegram-based RAT as “DLRAT.” We track the DLang-based downloader as “BottomLoader.”


• Our latest findings indicate a definitive shift in the …

access blacksmith bots calling campaign cisco cisco talos command families lazarus lazarus group malware medium novel organizations rats remote access remote access trojans talos telegram trojans written