A new global campaign being tracked as Operation Blacksmith has been tied back to the Lazarus Group, the notorious North-Korean-linked threat actors. The operation exploits security flaws in Log4j to install previously undocumented remote access trojans (RATs) onto victims’ devices. Researchers have observed the use of three (3) DLang-based malware families so far including NineRAT, which uses Telegram to establish command-and-control (C2). The vulnerability these attacks are currently exploiting is being tracked as CVE-2021-44228, also known as Log4Shell, and the manufacturing, agriculture, and physical security sectors have been the main targets. Researchers have tied these latest tactics more specifically to the Lazarus sub-group Andariel (aka Onyx Sleet) who is often seen engaging in initial access, reconnaissance, and the establishment of longer-term access for Lazurus group activities. The NineRAT malware is used in these attacks as the main channel for interaction with infected endpoints and has the capability to send commands that help gather system information, upload, and download files, as well as uninstall and upgrade itself, all while using the legitimate Telegram messaging service for C2 communications that help enable detection evasion. The multitude of tools observed in use for Operation Blacksmith for backdoor access shows an overall high degree for persistent access. CTIX analysts will continue to monitor the ongoing operation for evolving developments.