A new campaign was discovered last week by researchers linking back to threat actors connected to the North Korean government’s Lazarus group. Lazarus has been around since as far back as 2009, launching sophisticated attacks aligned with the interests of North Korea and spanning across the three (3) pillars of cybercriminal activities, including cyberespionage, cyber sabotage, and the pursuit of financial gains. The majority of cyberattacks conducted by North Korean-aligned threat actors are in pursuit of the country’s developing nuclear weapons program, either in the form of stealing monetary assets to fund the program or hacking into companies and acquiring the data or technical knowledge to support their efforts. This attack against a Spanish aerospace company is therefore not an unusual target for a North Korean-aligned APT group like this. The hackers were able to access the aerospace company’s corporate network utilizing tactics from their ongoing “Operation Dreamjob” campaign, which entails using targeted job recruitment lures that impersonate fake employees to engage the target via LinkedIn to begin a recruitment process that at some point requires the victim to download a malicious file. The attack on the Spanish aerospace company began with a message by the Lazarus actor pretending to be a Meta (Facebook) recruiter on LinkedIn. Later in the conversation, the threat actor provided the victim with coding quizzes to prove their programming proficiency. After the quiz is downloaded by the victim (shared as executables within ISO files), malicious files infect the victim’s device with a backdoor that allows for espionage to be conducted. A worrisome discovery was the existence of a new type of payload called “LightlessCan”, a more complex and sophisticated evolution of its predecessor, “BlindingCan”. LightlessCan’s payload was also encrypted, with only a key dependent on the target’s environment being available to decrypt it, effectively preventing outside access to the victim’s computer by security researchers or analysts. The heightened malicious capabilities of this new payload and the expansion of Lazarus’ Operation Dreamjob campaign to focus on espionage goals beyond the financial objectives are a concerning development for organizations likely to be targeted by the group.