Memory-safe languages so hot right now, agrees Lazarus Group as it slings DLang malware

Cisco Talos attributes ‘Operation Blacksmith’ to Andariel (a Lazarus Group subdivision), detailing active exploitation of Log4Shell (CVE-2021-44228) to deploy at least three DLang-based malware strains—NineRAT (Telegram-based RAT/C2), BottomLoader (downloader using PowerShell and Startup persistence), and DLRAT (downloader + RAT features)—against organizations in manufacturing, agriculture, and physical security between March and October 2023; the report also highlights a trend of threat actors adopting memory-safe languages for malware development.