Threat Group Cards: A Threat Actor Encyclopedia
Archived: 2026-04-05 17:28:43 UTC
Home > List all groups > List all tools > List all groups using tool LightlessCan
 Tool: LightlessCan
Names LightlessCan
Category Malware
Type Backdoor
Description
(ESET) The most interesting payload used in this campaign is LightlessCan, a successor of the
group’s flagship HTTP(S) Lazarus RAT named BLINDINGCAN. LightlessCan is a new
complex RAT that has support for up to 68 distinct commands, indexed in a custom function
table, but in the current version, 1.0, only 43 of those commands are implemented with some
functionality. The remaining commands are present but have a formal implementation in the
form of placeholders, lacking actual functionality. The project behind the RAT is definitely
based on the BlindingCan source code, as the order of the shared commands is preserved
significantly, even though there may be differences in their indexing.
Information
Malpedia Last change to this tool card: 17 January 2024
Download this tool card in JSON format
All groups using tool LightlessCan
Changed Name Country Observed
APT groups
 Lazarus Group, Hidden Cobra, Labyrinth Chollima 2007-May 2025
1 group listed (1 APT, 0 other, 0 unknown)
https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=38856463-ecc8-498e-8117-04f4026acae0
Page 1 of 2

Source: https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=38856463-ecc8-498e-8117-04f4026acae0
https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=38856463-ecc8-498e-8117-04f4026acae0
Page 2 of 2

APT groups Lazarus Group, Hidden Cobra, Labyrinth Chollima 2007-May 2025
1 group listed (1 APT, 0 other, 0 unknown) 
   Page 1 of 2