Comebacker

Comebacker is a Lazarus-linked custom backdoor and loader, also described in the content as a Diamond Sleet-linked backdoor/loader and in one report as a dangerous trojan delivered through malicious Python and npm packages. It has been observed in multiple North Korea-associated intrusion sets and is repeatedly described as exclusively associated with Lazarus, although some reporting notes overlap with Diamond Sleet/Pompilus and uncertainty about the exact Lazarus subgroup responsible in some campaigns.

The malware has been used alongside other Lazarus tooling including BLINDINGCAN, InfoHook, ChromeStealer, RP_Proxy, Mimikatz, Curl, and Medusa ransomware. Multiple reports state that BLINDINGCAN has been used in conjunction with Comebacker, and one report describes a new Comebacker variant leading to deployment of a new BLINDINGCAN remote access trojan variant. In current ransomware and extortion campaigns attributed to Lazarus, Comebacker was part of a broader toolset used before ransomware deployment to maintain access and support follow-on activity.

Observed delivery and infection vectors in the content include embedding Comebacker in seemingly innocuous Python and npm packages, including malicious PyPI packages downloaded by developers onto Windows systems. Microsoft reporting cited in the content states Lazarus used Comebacker in February by embedding it in Python and npm packages to establish contact with a command-and-control server and retrieve additional payloads. Another report says developers tricked into downloading malicious software packages on Windows were infected with Comebacker.

Technical behavior directly described in the content includes variants observed as both a DLL and EXE, command-line parameter validation, service selection by enumerating Svchost netsvcs entries and choosing an unregistered service name, decryption of embedded payloads, decompression, writing files to disk, moving a service DLL into the Windows system32 directory, and storing configuration in the registry. One Lazarus infection chain report states Comebacker used HC256 and RC4 for string and configuration decryption, wrote timestamp data to C:\Windows\system32\AppxProvision.xml, dropped a decoy file named kjepl.xml, and stored configuration under HKLM\SYSTEM\ControlSet001\Services\kbddes\GUID. That same report says Comebacker deployed a service-stage wrapper, Compcat_v1.dll, which memory-loaded a new BLINDINGCAN variant. Separate reporting also describes a ChaCha20-encrypted Comebacker backdoor used in attacks on aerospace and defense organizations.

Targeting and campaign context in the content include Lazarus operations against aerospace and defense, software/IT, education, defense industrial base, U.S. healthcare, nonprofits, and an unnamed Middle East organization. Comebacker is specifically mentioned in Lazarus Medusa ransomware activity affecting or attempting to affect U.S. healthcare and Middle East targets, and in developer-focused supply-chain style campaigns using malicious package repositories. Microsoft also reported that Moonstone Sleet reused code from known Lazarus malware such as Comebacker.

High-confidence indicators and artifacts directly mentioned in the content include file paths C:\ProgramData\comms.bin and C:\ProgramData\Comms\ssh.bin; required execution parameters up45V3FR9ee9 and 760H33ls9L5S; the file C:\Windows\system32\AppxProvision.xml; decoy file kjepl.xml; registry path HKLM\SYSTEM\ControlSet001\Services\kbddes\GUID; and associated C2 infrastructure hxxp://166[.]88[.]11[.]10/upload/check.asp, hxxps://tronracing[.]com/upload/check.asp, and hxxp://23[.]27[.]140[.]49/Onenote/index.asp.