ENKI researchers documented in a report published by ENKI Whitehat a targeted espionage campaign by Lazarus Group deploying a new Comebacker backdoor variant against aerospace and defense sector organizations, with lure documents impersonating Edge Group, IIT Kanpur, and Airbus — and infrastructure pivots revealing a related sample with campaign activity dating back to at least March 2025. The new variant introduces ChaCha20 encryption across loader stages and AES-128-CBC encrypted C2 communications, departing from prior variants' HC256 ciphers and plaintext C2.
Infection Chain: DOCX Macro to Four-Stage In-Memory Execution
The infection begins with malicious .docx files hosted on an open directory at office-theme[.]com, each containing a VBA macro with two embedded components stored as hexadecimal strings encrypted via a custom XOR/bit-swap algorithm. When the victim enables macros, the decrypted components are written to disk:
- Stage 1 Loader:
C:\ProgramData\WPSOffice\wpsoffice_aam.ocx— loaded immediately viaLoadLibraryA - Decoy Document:
C:\ProgramData\Document\EDGE_Group_Interview_NDA.docx— opened to maintain victim deception
The Stage 1 loader (wpsoffice_aam.ocx) decrypts an embedded payload using ChaCha20 (key: ad9c5aca9977d04c73be579199a827049b6dd9840091ffe8e23acc05e1d4a657, IV: edc9ce049daeba35b8687740, counter: 1), decompresses via zlib, and writes the Stage 2 loader to C:\ProgramData\USOShared\USOPrivate.dll. Persistence is established via a Startup folder shortcut (Micro.lnk) executing USOPrivate.dll via rundll32.exe with the LoadMimi export. The Stage 2 loader reuses the identical ChaCha20 parameters to decrypt and load the final Comebacker payload directly into memory, triggering execution via the GetWindowSizedW export with argument "1282".
Comebacker: Victim ID, AES-Encrypted C2, and Download-Execute Protocol
Upon execution, Comebacker generates a unique victim identifier by concatenating a random 10-character alphanumeric string, the execution argument ("1282"), and the static string "64". All C2 communications occur over HTTPS to hxxps://hiremployee[.]com, with outbound data encrypted using AES-128-CBC (key and IV both: x!P<&}mjH2YHRQ') and Base64-encoded. The initial beacon encodes victim metadata in randomized URL query string parameter names. The C2 response protocol uses a structured format to direct behavior: response code 13 terminates the process; decoded message "0" triggers a 60-second sleep-retry loop (escalating to 20-minute intervals after 20 consecutive zeros); decoded "1" triggers a 10-second sleep before rebeaconing. Non-control responses carry a download-execute command ([command]|[encrypted size]|[export name]|[argument]|[MD5 hash]), with MD5 hash verification before ChaCha20 decryption and in-memory execution of the downloaded payload.
March 2025 Variant: HC256 Continuity and Infrastructure Overlap
Infrastructure pivoting via VirusTotal Relations identified a second C2 domain, birancearea[.]com, first scanned in March 2025, with an associated Comebacker sample (SHA256: f2b3867aa06fb38d1505b3c2b9e523d83f906995dcdd1bb384a1087b385bfc50). This variant uses HC256 with the key/IV LH*x239udC<*sd_Sej%lOa0$&ujHl(.R — identical to the 2024 PyPI-distributed Comebacker samples — and requires the command-line argument "9Ez6THDirL6Zye4" for execution. Its Stage 2 loader (USOInfo.dat) uses a second distinct HC256 key/IV (6w6ZT9|a-0}s$@;(@&#jPVC4o+V?1IU%) and calls GetWindowSizedW with argument "3718".
Comebacker Evolution: Four Years of Cipher Progression
ENKI traced Comebacker's cryptographic evolution across four campaign generations: the 2021 security researcher campaign (first reported by Google TAG) used RC4 or HC256 with shared key/IV; the 2024 PyPI typosquatting campaign used HC256 with consistent keys; the March 2025 variant continued HC256 reuse; and the June 2025 campaign introduced a custom XOR/bit-swap dropper layer and replaced HC256 with ChaCha20 throughout the loader chain. Most significantly, C2 communications evolved from plaintext in all prior variants to AES-128-CBC encryption in the 2025 campaigns — a direct operational security improvement that complicates traffic-based detection. The C2 infrastructure at hiremployee[.]com remained active at publication.