Lazarus Group deploys new Comebacker variant against aerospace and defence sectors

Rafi Mahmood

Observed in the wild

• On 7 November, Enki White Hat Threat Intelligence disclosed a targeted espionage campaign by North Korea–linked Lazarus Group, delivering a new C++-based Comebacker backdoor variant to aerospace and defence targets since at least March 2025. Lures included spear-phishing documents themed around organisations like Edge Group, Airbus, and IIT Kanpur.
• The infection chain begins with malicious .docx files hosting VBA macros. When enabled, these macros deploy and execute a multi-stage loader DLL using a custom XOR/bit-swap decryption process, which in turn decrypts and executes a second-stage payload in memory. Persistence is achieved via shortcuts in Startup folders.
• The final Comebacker payload operates entirely in memory, using ChaCha20 for payload decryption and AES-128-CBC for encrypted C2 communication over HTTPS. Commands include beaconing, downloading additional payloads upon MD5 verification, and in-memory execution. Infrastructure pivots uncovered two C2 domains and confirmed reuse of cipher keys and protocols across variants.
• Organisations are advised to implement macro-blocking policies and disable execution of unsigned Office macros, and monitor for persistence artifacts like malicious .lnk files in Startup folders and unrecognised DLL loader activity.

Lazarus Group targets Aerospace and Defense with new Comebacker variant | Enki White Hat