Lazarus Group Attacks Aerospace/Defense with New ChaCha20-Encrypted Comebacker Backdoor

Cybersecurity researchers at ENKI have identified a new variant of the Comebacker backdoor attributed to the Lazarus Group in a targeted espionage campaign against the aerospace and defence sectors. The campaign uses malicious Word documents with VBA macros to deploy a three-stage, memory-resident infection chain, with ChaCha20 encryption for payloads and AES-128-CBC for C2 traffic.

ENKI notes four decoy documents impersonating organisations in the aerospace and defence sector, including Edge Group, IIT Kanpur, and Airbus, suggesting the objective is espionage. The infection chain culminates in a Comebacker payload that establishes persistence and communicates with C2 domains hiremployee[.]com and birancearea[.]com over HTTPS with a custom AES-128-CBC scheme.

The campaign appears to have been active since at least March 2025, and the operators reuse Lazarus’ cryptographic framework across toolsets, switching between HC256 and ChaCha20 as needed. According to ENKI researchers, the technique broadens from earlier campaigns that targeted researchers and developers to now directly targeting aerospace engineers and defence partners.