Lazarus Group Targets Nuclear Industry with CookiePlus Malware

Securelist/Kaspersky reports that the Lazarus Group has shifted focus to targeting personnel in the nuclear industry using fake job postings (Operation DreamJob) to deliver modular, in-memory malware (notably a plugin called CookiePlus) via Ranid Downloader and related payloads; the group also leveraged a Chrome zero-day and macOS-focused techniques (RustyAttr), demonstrating high sophistication and active operations in January 2024.