New-North-Korean-based-backdoor-packs-a-punch.pdf (6 MB)

CyberArmor analyzes a newly observed North Korean campaign named Niki that targets aerospace and defense companies with job-description lures. The intrusion begins with a RAR archive masquerading as a ZIP file for a General Dynamics safety manager role, which drops a decoy PDF and executes a Windows DLL backdoor through PowerShell, certutil, and regsvr32. The backdoor, internally named httpSpy.dll, persists as a Windows service called CacheDB, decrypts its command-and-control configuration, and supports reconnaissance and follow-on payload delivery. The report highlights extensive string and API obfuscation, Korean-language document metadata, and indicators including the lure archive, JSE dropper, DLL hashes, file paths, and HTTP POST-based C2 behavior. The activity matters because it shows continued North Korea-linked interest in aerospace and defense targets using tailored recruitment-themed delivery and a previously undocumented lightweight backdoor.