Malware
LightlessCan
aka SIDESHOW
LightlessCan is a complex HTTP(S) RAT, that is a successor of the Lazarus RAT named BlindingCan.
LightlessCan, also known as SIDESHOW, is a Windows malware family operated by Lazarus Group.
Background
LightlessCan is a sophisticated HTTP(S) RAT that succeeds the Lazarus RAT known as BlindingCan.
It was used in targeted intrusions during Q2 2022 and Q1 2023 against an aerospace firm in Spain and a technology company in India.
Beyond the commands already found in BlindingCan, its headline addition is the emulation of many native Windows commands: • ipconfig • net • netsh advfirewall firewall • netstat • reg • sc • ping (for both IPv4 and IPv6 protocols) • wmic process call create • nslookup • schstasks • systeminfo • arp
Attackers commonly lean on these native commands once they have established a foothold. By running them quietly inside the RAT itself instead of in a visible system console, LightlessCan stays stealthy, dodging both real-time tools like EDRs and after-the-fact digital forensics.
For decrypting its configuration as well as encrypting and decrypting network traffic, LightlessCan relies on RC6.
Source: Malpedia (Fraunhofer FKIE).