The pulse cluster describes a Lazarus intrusion against a Spanish aerospace company that fits the long-running Operation DreamJob playbook: socially engineered job outreach, a trojanized technical assessment, and staged Windows payloads designed for cyberespionage rather than fast monetization. The lure is precise: employees are approached on LinkedIn by personas posing as Meta recruiters, then pushed into running a coding challenge that doubles as an initial-access loader.
The collective attack chain is: LinkedIn recruiter persona -> direct message or off-platform handoff -> coding challenge archive or project -> execution of a seemingly legitimate task binary -> DLL side-loading from a user-writable path -> NickelLoader staging -> BLINDINGCAN or miniBlindingCan remote access -> LightlessCan for modular, stealthy post-compromise control. LightlessCan is notable because it can emulate or wrap native Windows command behavior, allowing operators to blend host discovery and lateral movement into expected admin noise. The objective is sustained access to aerospace engineering, program, supplier, and identity data, with plausible interest in export-controlled technical information and trusted relationships that enable follow-on intrusions.
Threat Actor / Malware Profile
Lazarus is a DPRK-nexus adversary with a history of defense, aerospace, cryptocurrency, and supply-chain operations. In this activity, the operator trade-craft favors credible recruitment pretexts and developer-centric delivery because engineers are more likely to run project files, test harnesses, and unsigned challenge binaries on corporate endpoints.
- Distribution method: LinkedIn spearphishing using recruiter personas, followed by a trojanized coding challenge, project bundle, or archive delivered through chat, email, or a file-sharing handoff.
- Payload behavior: the challenge package acts as a benign-looking execution wrapper; NickelLoader stages follow-on payloads; BLINDINGCAN and miniBlindingCan provide remote access and tasking; LightlessCan supports modular commands and can imitate native Windows command output to reduce analyst suspicion.
- C2 communication: HTTPS to actor-controlled or compromised infrastructure, including web paths that resemble ordinary PHP include or WordPress content such as /include/include.php and /wp-includes/contacts.php. The IPv4 indicators should be treated as C2, relay, or staging nodes until passive DNS and certificate data prove otherwise.
- Persistence mechanism: expected patterns include Run keys, scheduled tasks, services, or persistence via a side-loaded DLL launched by a trusted signed binary. Aerospace environments should also check developer tools, IDE extensions, build agents, and remote admin tooling for unauthorized startup entries.
- Anti-analysis techniques: DLL side-loading to borrow the reputation of legitimate executables, use of compromised websites to dilute reputation signals, command semantics that mimic native utilities, staged payloads that delay beaconing, and selective execution after social validation by the victim.
IOC Analysis
The indicator set is network-led: 43 indicators with IPv4 addresses, domains, and URLs rather than only file hashes. That means first-line value is in egress control, DNS visibility, proxy telemetry, TLS SNI inspection where lawful, and retrospective NetFlow or firewall hunts. Hashes, if later enriched from the referenced research, should be deployed to EDR and YARA, but network controls should not wait for hash confirmation.
Operationalize the IPv4 indicators 178.251.26.65, 118.98.221.14, 50.192.28.29, and 199.188.206.75 as block-and-hunt indicators, not merely watchlist entries. Confirm whether they are actor-owned VPS, compromised residential nodes, or transient cloud infrastructure before assigning confidence and expiry. Domains turnscor.com and barsaji.com.mx, plus URLs such as https://hurricanepub.com/include/include.php and https://turnscor.com/wp-includes/contacts.php, should be decoded as full URI, host, SNI, DNS query, and TLS certificate observables. URL indicators are especially important because blocking only the domain can miss legitimate shared hosting, while blocking only the full path can miss domain rotation.
Recommended tooling flow: ingest indicators into MISP or a TIP with confidence, first-seen, last-seen, and expiry; convert to firewall, DNS sinkhole, secure web gateway, EDR network block, and Sentinel analytics; enrich through passive DNS, WHOIS, urlscan, VirusTotal, AbuseIPDB, Greynoise, certificate transparency, Zeek or Suricata logs, and OTX related pulses. SOC teams should retro-hunt at least 90 days for developer workstations, build systems, and users with aerospace program access, and should alert on process lineage around coding challenges rather than network matches alone.
Detection Engineering
Deploy the following Sigma pack for endpoint and network telemetry focused on trojanized challenge execution, DLL side-loading, LightlessCan-style native command blending, and OTX-listed egress infrastructure.
---
title: Lazarus Operation DreamJob Trojanized Coding Challenge DLL Side-Load
id: 7f3b2c21-8c4e-4d29-9a21-lazdreamjob01
status: experimental
description: Detects DLL side-loading from user-writable locations consistent with trojanized coding challenges used in Lazarus Operation DreamJob aerospace targeting.
references:
- https://www.welivesecurity.com/en/eset-research/lazarus-luring-employees-trojanized-coding-challenges-case-spanish-aerospace-company
author: Security Arsenal Detection Engineering
date: 2026/09/21
modified: 2026/09/21
logsource:
category: image_load
product: windows
detection:
selection_user_dll:
ImageLoaded|startswith: 'C:\Users\'
ImageLoaded|endswith: '.dll'
selection_locations:
ImageLoaded|contains:
- '\AppData\Local\Temp\'
- '\AppData\Roaming\'
- '\Downloads\'
- '\Desktop\'
selection_lure_names:
ImageLoaded|contains:
- 'challenge'
- 'coding'
- 'test'
- 'interview'
- 'meta'
filter_system:
ImageLoaded|startswith:
- 'C:\Windows\System32\'
- 'C:\Windows\SysWOW64\'
- 'C:\Program Files\'
- 'C:\Program Files (x86)\'
condition: selection_user_dll and selection_locations and selection_lure_names and not filter_system
fields:
- Image
- ImageLoaded
- CommandLine
- ParentImage
- User
- Computer
falsepositives:
- Legitimate developer tools loading plugins from user profile directories
- Corporate software packaging that stages DLLs in temp paths
level: high
tags:
- attack.defense_evasion
- attack.t1574.002
- attack.initial_access
- attack.t1566.001
---
title: LightlessCan Native Command Masquerading From Non-Standard Parent
id: 8b1ad344-6a51-4f9b-b710-lightlesscan02
status: experimental
description: Detects bursts of native Windows discovery commands spawned by IDEs, browsers, archives, or challenge executables after suspected Operation DreamJob execution.
references:
- https://www.welivesecurity.com/en/eset-research/lazarus-luring-employees-trojanized-coding-challenges-case-spanish-aerospace-company
author: Security Arsenal Detection Engineering
date: 2026/09/21
modified: 2026/09/21
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|endswith:
- '\Code.exe'
- '\devenv.exe'
- '\msedge.exe'
- '\chrome.exe'
- '\7z.exe'
- '\winrar.exe'
- '\powershell.exe'
- '\cmd.exe'
selection_parent_userpath:
ParentImage|startswith: 'C:\Users\'
selection_child:
Image|endswith:
- '\cmd.exe'
- '\powershell.exe'
- '\rundll32.exe'
- '\regsvr32.exe'
- '\whoami.exe'
- '\ipconfig.exe'
- '\netstat.exe'
- '\systeminfo.exe'
- '\tasklist.exe'
- '\nltest.exe'
- '\net.exe'
selection_cli:
CommandLine|contains:
- 'whoami'
- 'ipconfig /all'
- 'netstat -ano'
- 'systeminfo'
- 'tasklist'
- 'net user'
- 'nltest /dclist'
- 'reg query'
condition: selection_parent and selection_parent_userpath and selection_child and selection_cli
fields:
- Image
- ParentImage
- CommandLine
- ParentCommandLine
- User
- IntegrityLevel
- Hashes
falsepositives:
- Helpdesk troubleshooting initiated from developer machines
- Automated build scripts performing environment checks
level: medium
tags:
- attack.discovery
- attack.t1033
- attack.t1082
- attack.t1057
- attack.execution
---
title: Operation DreamJob OTX C2 and Staging Egress
id: 4d6e7789-1d90-4fb0-9c44-otxlazc203
status: experimental
description: Detects network connections to OTX-listed Lazarus Operation DreamJob IPv4, domain, and URL indicators associated with LightlessCan, NickelLoader, and BLINDINGCAN activity.
references:
- https://otx.alienvault.com
- https://www.welivesecurity.com/en/eset-research/lazarus-luring-employees-trojanized-coding-challenges-case-spanish-aerospace-company
author: Security Arsenal Detection Engineering
date: 2026/09/21
modified: 2026/09/21
logsource:
category: network_connection
product: windows
detection:
selection_ip:
DestinationIp:
- '178.251.26.65'
- '118.98.221.14'
- '50.192.28.29'
- '199.188.206.75'
selection_domain:
DestinationHostname|contains:
- 'turnscor.com'
- 'barsaji.com.mx'
- 'hurricanepub.com'
selection_url_path:
DestinationHostname|contains:
- 'hurricanepub.com'
- 'turnscor.com'
Initiated: 'true'
condition: selection_ip or selection_domain or selection_url_path
fields:
- Image
- ProcessId
- DestinationIp
- DestinationHostname
- DestinationPort
- Protocol
- User
- Computer
falsepositives:
- Threat intelligence validation or sandbox detonation
- Security scanner verification of blocked indicators
level: critical
tags:
- attack.command_and_control
- attack.t1071.001
- attack.t1102
Hunt in Microsoft Sentinel for endpoint network matches and the process context that made the connection.
let DreamJobIPs = dynamic(['178.251.26.65','118.98.221.14','50.192.28.29','199.188.206.75']);
let DreamJobHosts = dynamic(['turnscor.com','barsaji.com.mx','hurricanepub.com']);
let DreamJobPaths = dynamic(['/include/include.php','/wp-includes/contacts.php']);
DeviceNetworkEvents
| where TimeGenerated > ago(90d)
| where RemoteIP in (DreamJobIPs)
or RemoteUrl has_any (DreamJobHosts)
or RemoteUrl has_any (DreamJobPaths)
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessParentFileName, RemoteIP, RemoteUrl, RemotePort, ActionType
| join kind=leftouter (
DeviceProcessEvents
| where TimeGenerated > ago(90d)
| project DeviceId, ProcessTime=TimeGenerated, FileName, ProcessCommandLine, FolderPath, SHA256, AccountName
) on DeviceName
| summarize FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), Connections=count(), Processes=make_set(InitiatingProcessFileName), CommandLines=make_set(InitiatingProcessCommandLine), RemoteEndpoints=make_set(strcat(RemoteIP, ':', RemotePort)) by DeviceName, InitiatingProcessParentFileName
| order by LastSeen desc
Run this read-only endpoint sweep to find persistence, challenge artifacts, DNS residue, and live egress matches.
$ErrorActionPreference = 'SilentlyContinue'
$ips = @('178.251.26.65','118.98.221.14','50.192.28.29','199.188.206.75')
$hosts = @('turnscor.com','barsaji.com.mx','hurricanepub.com')
$report = [ordered]@{ Hostname=$env:COMPUTERNAME; User=$env:USERNAME; Timestamp=(Get-Date).ToString('o') }
$report.LiveConnections = Get-NetTCPConnection -State Established,SynSent | Where-Object { $ips -contains $_.RemoteAddress } | Select-Object LocalAddress,LocalPort,RemoteAddress,RemotePort,State,OwningProcess,@{n='Process';e={(Get-Process -Id $_.OwningProcess).ProcessName}},@{n='Path';e={(Get-Process -Id $_.OwningProcess).Path}}
$report.DnsCacheHits = Get-DnsClientCache | Where-Object { $name=$_.Entry; $hosts | ForEach-Object { $name -like ('*' + $_ + '*') } } | Select-Object Entry,Data,TimeToLive
$userPaths = @($env:TEMP, [Environment]::GetFolderPath('Desktop'), [Environment]::GetFolderPath('Downloads'), "$env:APPDATA", "$env:LOCALAPPDATA")
$report.ChallengeArtifacts = foreach ($p in $userPaths) { Get-ChildItem -Path $p -Recurse -Force -ErrorAction SilentlyContinue | Where-Object { $_.Name -match '(challenge|coding|interview|meta|test|assessment)' -and $_.LastWriteTime -gt (Get-Date).AddDays(-120) } | Select-Object FullName,Length,CreationTime,LastWriteTime }
$report.RunKeys = @('HKCU:\Software\Microsoft\Windows\CurrentVersion\Run','HKLM:\Software\Microsoft\Windows\CurrentVersion\Run','HKLM:\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run') | ForEach-Object { Get-ItemProperty -Path $_ | Select-Object PSPath,* }
$report.ScheduledTasks = Get-ScheduledTask | Where-Object { ($_.Actions.Execute -match 'cmd|powershell|rundll32|regsvr32|wscript|cscript|mshta') -or ($_.TaskPath -notlike '\Microsoft\Windows\*') } | Select-Object TaskName,TaskPath,State,@{n='Actions';e={($_.Actions | ForEach-Object { ($_.Execute + ' ' + $_.Arguments) }) -join '; '}}
$report.SuspiciousEvents = Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-Sysmon/Operational'; Id=7; StartTime=(Get-Date).AddDays(-30)} -MaxEvents 2000 | Where-Object { $_.Message -match 'AppData|Downloads|Desktop|Temp' -and $_.Message -match '\.dll' } | Select-Object TimeCreated,Id,Message
$report | ConvertTo-Json -Depth 6
Response Priorities
Immediate: add the listed IPv4s, domains, hosts, and full URLs to DNS sinkhole, secure web gateway, EDR network block, firewall egress deny, and Sentinel watchlists with a 30 to 90 day expiry pending enrichment. Search Sysmon image-load, process creation, proxy, DNS, TLS SNI, and NetFlow telemetry for the IOCs and for coding-challenge execution from user-writable paths. Isolate any endpoint with an established or recent SYN connection to listed infrastructure, capture memory and triage artifacts before remediation, and preserve LinkedIn or chat lure material for attribution and legal handling.
24h: identify every targeted employee and any account that ran the challenge, then verify identity through an out-of-band channel because recruiter personas may continue interacting after detection. Reset credentials for users who executed payloads, revoke refresh tokens and OAuth grants, reissue MFA where session theft is plausible, and review sign-in logs for impossible travel, new device enrollment, mailbox rules, and cloud consent grants. Interview affected developers and HR partners to map who received the lure, which projects were opened, whether source code or VPN access was reachable, and whether build agents or service accounts were exposed.
1 week: harden the recruitment-to-engineering workflow by requiring sandbox detonation or browser isolation for unsolicited coding assessments, blocking execution from Downloads, Desktop, Temp, and user-profile staging paths for non-admin developer roles, and tightening DLL search order and side-loading controls where feasible. Add application control rules for challenge archives and unsigned test binaries, enable DLL load telemetry on engineering fleets, restrict outbound HTTPS to categorized destinations for high-risk aerospace groups, and create a joint playbook with HR, Legal, and Physical Security for recruiter impersonation. Validate restore points, rotate exposed secrets, and brief executives on likely espionage objectives rather than treating this as commodity malware.
Related Resources
Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub
Is your security operations ready?
Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.