MalwarePublished 10 Nov 2025

Lazarus Group targets Aerospace and Defense with new Comebacker variant

Source AlienVault OTX General

Description

The Lazarus Group, a DPRK-linked threat actor, has launched a targeted espionage campaign against aerospace and defense sectors using a new variant of the Comebacker backdoor. The attack employs spear phishing with highly specific lure documents to deliver macro-based malware. The infection chain is multi-staged, featuring custom decryption algorithms and encrypted command-and-control communications, indicating advanced evasion techniques. The campaign infrastructure remains active, suggesting ongoing operations. This threat poses risks to confidentiality and integrity of sensitive defense-related information. European aerospace and defense organizations should enhance phishing defenses and monitor for indicators such as specific file hashes and suspicious domains. No CVSS score is assigned, but the threat is assessed as high severity due to its targeted nature, potential impact, and sophisticated malware. Countries with significant aerospace and defense industries and geopolitical interest in DPRK activities are most at risk. Immediate mitigation includes user training, macro restrictions, network monitoring, and threat intelligence sharing.

Impact

For European organizations, particularly those in aerospace and defense, this campaign threatens the confidentiality of sensitive intellectual property, defense technologies, and strategic information. Successful compromise could lead to espionage, intellectual property theft, and potential sabotage or disruption of critical defense projects. The integrity of internal communications and data could be undermined, affecting operational security and trust. The availability of systems may also be impacted if the malware includes destructive capabilities or if remediation efforts require system downtime. The campaign's use of spear phishing and macro-based malware exploits human factors, making it challenging to defend solely with technical controls. The ongoing activity of the campaign infrastructure suggests a persistent threat, requiring continuous vigilance. European defense contractors and aerospace manufacturers involved in NATO or EU defense projects are particularly at risk, as stolen data could have broader geopolitical consequences. The threat also raises concerns about supply chain security and the protection of classified or proprietary information within European defense ecosystems.

Defensive guidance

1. Implement advanced email filtering solutions capable of detecting and quarantining spear phishing attempts, especially those containing macro-enabled documents. 2. Enforce strict macro policies by disabling macros by default and only allowing digitally signed macros from trusted sources. 3. Conduct targeted user awareness training focused on recognizing spear phishing and social engineering tactics specific to aerospace and defense contexts. 4. Deploy endpoint detection and response (EDR) tools with capabilities to detect multi-stage malware behaviors, custom decryption routines, and anomalous encrypted C2 traffic. 5. Monitor network traffic for connections to known malicious domains and IPs associated with the campaign, such as birancearea.com and hiremployee.com. 6. Utilize threat intelligence feeds to update detection signatures and IOC lists regularly. 7. Apply network segmentation to limit lateral movement within critical systems. 8. Conduct regular audits and incident response exercises simulating spear phishing and malware infection scenarios. 9. Collaborate with national cybersecurity centers and defense sector information sharing organizations to share intelligence and coordinate defenses. 10. Implement strict access controls and multi-factor authentication to reduce the impact of credential theft or lateral movement.

Summary

This threat involves a recent espionage campaign conducted by the Lazarus Group, a North Korean state-sponsored cyber threat actor known for sophisticated cyber operations. The campaign targets aerospace and defense organizations, sectors critical to national security and technological advancement. The attackers utilize a new variant of the Comebacker backdoor, which is a malware family previously linked to Lazarus operations. Infection begins with spear phishing emails containing highly tailored lure documents designed to entice specific individuals within target organizations. These documents leverage macro-based malware delivery, exploiting user interaction to execute malicious code. The malware employs a multi-stage infection chain, including custom decryption algorithms to evade detection and encrypted command-and-control (C2) communications to securely receive instructions and exfiltrate data. The use of encrypted C2 channels complicates network detection efforts. The campaign's infrastructure, including domains such as birancearea.com and hiremployee.com, remains active, indicating ongoing or future operations. The malware's capabilities likely include data theft, persistence mechanisms, and lateral movement within compromised networks. Indicators of compromise (IOCs) such as file hashes and malicious domains are provided to aid detection. The campaign reflects Lazarus Group's continuous refinement of their tools and tactics to maintain stealth and effectiveness in espionage activities. Given the targeted nature and sophistication, this campaign poses a significant threat to the confidentiality and integrity of sensitive aerospace and defense information.

Indicators of compromise

Domains 3

birancearea.com
hiremployee.com
office-theme.com

URLs 2

https://birancearea.com/adminv2
https://hiremployee.com

Hashes 20

126961b8c9a7a0e78899943f6c2a7ce9
c014a2ac8c89abc3799a520da331caf5
d90aeea054ae8cfbd6fca2bd1588a852
e4541d91fca9df943b6e119dc1c6cd7f
f5475608c0126582081e29927424f338
1bfcb157677167c4d5498a0821f3d40691f1e137
6c6419ee544e78448d0641f88ebd3ea2279f4f66
701296f6ff0daf3264dd8814c469b2c7f56df1ec
8e88fd82378794a17a4211fbf2ee2506b9636b02
a0e0a94417e9c594c5c68a6c815160c8b6a980ae

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 10 Nov 2025, 11:36 UTC

MITRE ATT&CK techniques13 from threat tags

Technical details

Indicators of compromise

Domains 3

URLs 2

Hashes 20

Community reviews

Related threats