Loading malware…
Comebacker is a custom Lazarus-associated Windows backdoor and loader used in multi-stage intrusion chains for espionage and financially motivated operations. It has been observed in campaigns targeting aerospace and defense-themed victims and in broader Lazarus activity linked to Medusa ransomware intrusions. The malware is also associated with Diamond Sleet and has been noted in operations showing code reuse by Moonstone Sleet.
Comebacker is typically deployed as an intermediate or final stage in layered execution chains. Observed delivery methods include malicious Microsoft Office documents with VBA macros and trojanized software packages, including malicious Python and npm packages aimed at developers. In one documented chain, a macro-enabled lure document decrypted and launched successive loader stages that established persistence and ultimately executed the Comebacker payload entirely in memory. Aerospace and defense-themed decoys and impersonation of related organizations indicate use in espionage-oriented targeting.
Functionally, Comebacker acts as a backdoor/loader that establishes command-and-control communications over HTTPS, generates a victim identifier, and supports beaconing with encrypted traffic. Reported variants use AES-128-CBC to protect outbound and inbound C2 data, while additional stages and downloaded payloads have been protected with ChaCha20; other reported variants used HC256 and RC4 for configuration and payload decryption. Comebacker can receive tasking from its controller, enter retry loops when instructed, terminate on command, and download, verify, decrypt, memory-load, and execute additional payloads by export name with supplied arguments. This makes it a flexible staging component for follow-on malware such as BLINDINGCAN.
Persistence has been observed through Windows startup mechanisms and service-based installation. Reported chains created startup-folder shortcuts to relaunch loader components, while other variants selected service names from existing svchost groupings and installed service DLLs with registry-backed configuration. Execution is commonly fileless or memory-resident at the final stage, and the malware uses custom decryption, compression, and dynamic loading routines to hinder analysis.
Comebacker has appeared alongside other Lazarus tooling including BLINDINGCAN, ChromeStealer, InfoHook, RP_Proxy, and Mimikatz. In ransomware-related intrusions, it has served as one component of a broader post-compromise toolkit used for access maintenance, credential theft, staging, and follow-on deployment. High-confidence reporting consistently places Comebacker within the Lazarus ecosystem as a bespoke backdoor/loader for Windows operations.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
5 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
We observed a new version of the Comebacker malware leading to a new variant of their BLINDINGCAN remote access tool.
Malware and Tools · Comebacker : Customized backdoor and loader associated with Lazarus
"The arsenal includes Comebacker, a custom backdoor and loader exclusively associated with the group"
"Tools Used In Recent Campaigns... Comebacker backdoor"
Moonstone Sleet ... extensively reusing code from known Diamond Sleet malware like Comebacker
21 distinct techniques documented for this family, organized by ATT&CK tactic.
"Comebacker... embedding it within seemingly innocuous Python and npm packages..." and "Alternate attack sequences have entailed the use of malicious npm packages... masquerading as... a technical skills assessment."
"Moonstone Sleet is observed to set up fake companies and job opportunities to engage with potential targets"; "delivering a trojanized version of PuTTY ... via apps like LinkedIn and Telegram as well as developer freelancing platforms"; "sending candidates a 'skills test' that instead delivers malware"
cmd.exe /C powershell -Command "$s = (New-Object -COMWScript.Shell).CreateShortcut('C:\\ProgramData\\USOShared\\Micro.lnk'); ... $s.Save()"
cmd.exe /C powershell -Command "$s = (New-Object -COMWScript.Shell).CreateShortcut(...)"
To establish persistence, the loader creates a shortcut ( .lnk ) to USOPrivate.dll in the user's Startup folder.
cmd.exe /C powershell -Command "$s = (New-Object -COMWScript.Shell).CreateShortcut('C:\\ProgramData\\USOShared\\Micro.lnk'); $s.TargetPath = 'C:\\Windows\\System32\\rundll32.exe'; $s.Arguments = '\"[USOPrivate.dll path]\" LoadMimi \"C:\\Windows\\System32\\cmd.exe\"'; $s.Save()"
To establish persistence, the loader creates a shortcut ( .lnk ) to USOPrivate.dll in the user's Startup folder.
cmd.exe /C powershell -Command "$s = (New-Object -COMWScript.Shell).CreateShortcut('C:\\ProgramData\\USOShared\\Micro.lnk'); $s.TargetPath = 'C:\\Windows\\System32\\rundll32.exe'; $s.Arguments = '\"[USOPrivate.dll path]\" LoadMimi \"C:\\Windows\\System32\\cmd.exe\"'; $s.Save()"
Following decryption, the loader decompresses the resulting data using the zlib library.
Following decryption, the loader decompresses the resulting data using the zlib library.
The macro decrypts and deploys two embedded components that are stored as large hexadecimal strings: a loader DLL and a decoy document.
"...establish contact with a command-and-control (C2) server to retrieve additional payloads." and "...execute a portable executable received from a C2 server."
The malware then prepares to beacon out to its hardcoded C&C server: hxxps://hiremployee[.]com
If the server's response does not match any of the control commands, the malware downloads and executes a payload from the message... If a message that satisfies the above condition is received, it downloads the encrypted file from the C&C server and executes it.
8 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
21 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Lazarus와 연계된 맞춤형 백도어 및 로더로, 침투 후 추가 페이로드 전달과 지속성 확보에 사용된다.
Customized backdoor and loader associated with Lazarus, used to support penetration and follow-on malicious activity in Medusa-linked campaigns.
Tool used by Lazarus in current campaigns (exact functionality not detailed in the content).
Custom backdoor/trojan used for lasting access as part of Lazarus intrusions that culminate in ransomware deployment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.