Lazarus luring employees with trojanized coding challenges: The case of a Spanish aerospace company

A Lazarus group cyberespionage campaign targeted a Spanish aerospace company by impersonating Meta recruiters on LinkedIn and sending trojanized coding challenges. The attack used spearphishing via LinkedIn Messaging to deliver malicious executables disguised as C++ programming tests. The campaign deployed multiple malware tools including LightlessCan, a new backdoor with enhanced stealth and command capabilities, NickelLoader downloader, and miniBlindingCan variant. DLL side-loading was used to load payloads, and the attack aimed to steal aerospace technology and know-how, aligning with North Korean strategic interests.

• Dissection of Operation FlashHole, a complex attack by LazarusMalware2026-10-21
• Binance heist: what we know, and what we see in TraderTraitor's toolkitMalware2026-11-05
• RARLAB WinRAR · Gorbag: Orcs at the border harvesting intelligence from UkraineExploitedMalware2026-11-03
• BITTER Expands Its Arsenal with PapRATMalware2026-11-03
• SEO Poisoning Campaign Targets DeepSeek Users: Chinese Threat Actor Deploys Kong RAT via Multi-Stage AttacksMalware2026-10-29