Lazarus Operation Dream Job: LightlessCan & NickelLoader Target Aerospace via Trojanized Coding Challenges — OTX Pulse Detection Pack

---
title: Lazarus LightlessCan DLL Side-Loading via NickelLoader
id: 8f3a2b1c-laza-2026-0001
status: experimental
description: Detects DLL side-loading patterns associated with NickelLoader staging LightlessCan — unsigned DLL loaded from non-standard directory by a signed legitimate binary
date: 2026/10/18
author: Security Arsenal Threat Intelligence
references:
  - https://www.welivesecurity.com/en/eset-research/lazarus-luring-employees-trojanized-coding-challenges-case-spanish-aerospace-company
logsource:
  category: image_load
  product: windows
detection:
  selection_path:
    ImageLoaded|contains:
      - '\Downloads\'
      - '\AppData\Local\Temp\'
      - '\AppData\Roaming\'
      - '\Users\Public\'
      - '\ProgramData\'
  selection_unsigned:
    Signed: 'false'
  filter_system:
    ImageLoaded|contains:
      - '\Windows\System32\'
      - '\Windows\SysWOW64\'
  condition: selection_path and selection_unsigned and not filter_system
level: high
tags:
  - attack.defense_evasion
  - attack.t1574.002
  - attack.persistence
---
title: Lazarus LightlessCan C2 Communication — Known Dream Job Infrastructure
id: 8f3a2b1c-laza-2026-0002
status: experimental
description: Detects network connections to known Lazarus Operation Dream Job C2 domains from the OTX pulse on the Spanish aerospace intrusion
date: 2026/10/18
author: Security Arsenal Threat Intelligence
references:
  - https://otx.alienvault.com
logsource:
  category: dns
  product: windows
detection:
  selection:
    QueryName|contains:
      - 'turnscor.com'
      - 'hurricanepub.com'
      - 'barsaji.com.mx'
      - 'keewoom.co.kr'
      - 'mantis.quick.net.pl'
  condition: selection
level: critical
tags:
  - attack.command_and_control
  - attack.t1071.001
---
title: Trojanized Coding Challenge Execution — Suspicious Dev Tool Child Processes
id: 8f3a2b1c-laza-2026-0003
status: experimental
description: Detects suspicious child processes spawned by build tools, IDEs, or executables launched from Downloads — consistent with trojanized coding challenge payloads delivered via LinkedIn recruiter lures
date: 2026/10/18
author: Security Arsenal Threat Intelligence
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|contains:
      - '\Downloads\'
    ParentImage|endswith:
      - '.exe'
  selection_child:
    Image|endswith:
      - '\powershell.exe'
      - '\cmd.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\mshta.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\msbuild.exe'
  condition: selection_parent and selection_child
level: high
tags:
  - attack.execution
  - attack.t1059
  - attack.t1204.002

// Lazarus Operation Dream Job — LightlessCan/NickelLoader hunt
// Targets: C2 comms to pulse IOCs + suspicious DLL side-loading + downloads-origin execution
let dreamjob_iocs = dynamic(["turnscor.com","hurricanepub.com","barsaji.com.mx","keewoom.co.kr","mantis.quick.net.pl"]);
let c2_events = DeviceNetworkEvents
| where TimeGenerated > ago(30d)
| where RemoteUrl has_any (dreamjob_iocs)
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteUrl, RemoteIP, ActionType;
let sideload_events = DeviceImageLoadEvents
| where TimeGenerated > ago(30d)
| where FolderPath has_any (@"\Downloads\", @"\AppData\Local\Temp\", @"\Users\Public\", @"\AppData\Roaming\")
| join kind=inner (DeviceProcessEvents | project DeviceId, ProcessId, FileName, ProcessCommandLine, TimeGenerated) on DeviceId, $left.InitiatingProcessId == $right.ProcessId
| project TimeGenerated, DeviceName, FileName, FolderPath, SHA256, ProcessCommandLine;
let exec_events = DeviceProcessEvents
| where TimeGenerated > ago(30d)
| where InitiatingProcessFolderPath has @"\Downloads\"
| where FileName in~ ("powershell.exe","cmd.exe","rundll32.exe","regsvr32.exe","mshta.exe","msbuild.exe")
| project TimeGenerated, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine;
union c2_events, exec_events
| order by TimeGenerated desc

# Lazarus Dream Job IOC Hunt — LightlessCan / NickelLoader / BLINDINGCAN
# Run elevated on suspected endpoints. Checks persistence, network, and staging artifacts.

$IOCDomains = @("turnscor.com","hurricanepub.com","barsaji.com.mx","keewoom.co.kr","mantis.quick.net.pl")
$StagingPaths = @("$env:USERPROFILE\Downloads","$env:APPDATA","$env:LOCALAPPDATA\Temp","C:\Users\Public","C:\ProgramData")
$Findings = @()

Write-Host "[1/5] Checking DNS cache for Dream Job C2 domains..." -ForegroundColor Cyan
$dns = Get-DnsClientCache | Where-Object { $d = $_.Entry; $IOCDomains | Where-Object { $d -like "*$_*" } }
if ($dns) { $Findings += "DNS CACHE HIT: $($dns.Entry -join ', ')" }

Write-Host "[2/5] Checking active network connections..." -ForegroundColor Cyan
Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue | ForEach-Object {
    try {
        $r = Resolve-DnsName $_.RemoteAddress -ErrorAction SilentlyContinue
        if ($r -and ($IOCDomains | Where-Object { $r.NameHost -like "*$_*" })) {
            $proc = Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue
            $Findings += "ACTIVE C2: $($r.NameHost) via $($proc.ProcessName) (PID $($_.OwningProcess))"
        }
    } catch {}
}

Write-Host "[3/5] Scanning Run keys and services for persistence..." -ForegroundColor Cyan
$runKeys = @("HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run","HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run")
foreach ($k in $runKeys) {
    Get-ItemProperty $k -ErrorAction SilentlyContinue | Get-Member -MemberType NoteProperty | ForEach-Object {
        $val = (Get-ItemProperty $k -Name $_.Name -ErrorAction SilentlyContinue).($_.Name)
        if ($val -match "Temp|Downloads|Public|AppData") { $Findings += "PERSISTENCE: $k -> $($_.Name) = $val" }
    }
}

Write-Host "[4/5] Checking scheduled tasks for non-standard user-context tasks..." -ForegroundColor Cyan
Get-ScheduledTask | Where-Object { $_.TaskPath -notlike "\Microsoft*" } | ForEach-Object {
    $action = $_.Actions.Execute
    if ($action -match "Temp|Downloads|Public|AppData") { $Findings += "SCHEDTASK: $($_.TaskName) -> $action" }
}

Write-Host "[5/5] Scanning staging paths for recently created unsigned DLLs/EXEs..." -ForegroundColor Cyan
foreach ($p in $StagingPaths) {
    Get-ChildItem $p -Recurse -Include *.dll,*.exe -ErrorAction SilentlyContinue |
    Where-Object { $_.CreationTime -gt (Get-Date).AddDays(-45) } | ForEach-Object {
        $sig = Get-AuthenticodeSignature $_.FullName
        if ($sig.Status -ne 'Valid') { $Findings += "UNSIGNED BINARY: $($_.FullName) created $($_.CreationTime)" }
    }
}

Write-Host "`n===== RESULTS =====" -ForegroundColor Yellow
if ($Findings.Count -eq 0) { Write-Host "No Dream Job artifacts found." -ForegroundColor Green }
else { $Findings | ForEach-Object { Write-Host $_ -ForegroundColor Red }; Write-Host "`n$($Findings.Count) findings — isolate host and escalate to IR." }