ctrlINT What the industry said about every indicator, with the quote

LightlessCanMalware

  • SIDESHOW

LightlessCan is a complex HTTP(S) RAT, that is a successor of the Lazarus RAT named BlindingCan. In Q2 2022 and Q1 2023, it was deployed in targeted attacks against an aerospace company in Spain and a technology company in India.From MISP Galaxy

Last reported 3 days ago, by Kaspersky Securelist2 reports

ATT&CK techniques

2 techniques · each with the sentence it comes from
  1. T1543.003Windows Service

    “…echHub in the chain: an in‑memory version, a simple DLL side‑loading version, and a DLL side‑loading version that uses a registered Windows service.”

    Kaspersky SecurelistVendor
  2. T1684Social Engineering

    “We also identified more weaponized GitHub repositories from the social engineering schemes used to target job seekers in these campaigns.”

    SentinelLabsVendor

Reports per month

last 12 months

October so far (hatched). Counted by report, not by story.

What the reports say

2 reports, newest first · the exact sentence from each

  1. “In those reports, Mandiant identified it as SIDESHOW, and ESET identified one of its modules as LightlessCan.”

    Kaspersky SecurelistVendor
    Operation FlashHole: Lazarus breaks security, defies control

  2. “…ed to directory and file operations, another tactic often used in more sophisticated North Korea-aligned toolsets, including Lazarus’ LightlessCan.”

    SentinelLabsVendor
    Don’t Call Us, We’ll Call Your APIs | TraderTraitor Backdoors Resurface on Victim With No Crypto Ties

Indicators in its reports

named in the reports above
Copy these 20 indicators · defanged

Thanks — we review every report.

Report a wrong match
What is wrong with LightlessCan here?
No account needed. We do not store your IP address.