LightlessCan is a sophisticated remote access trojan (RAT) developed by the Lazarus Group, a North Korean state-sponsored threat actor. This malware represents a significant evolution from its predecessor BlindingCan, adding capabilities that make it harder to detect and more dangerous to enterprise networks. First observed in targeted attacks during 2022 and 2023 against aerospace and technology companies in Spain and India, LightlessCan has since appeared in campaigns affecting organizations worldwide. Unlike generic malware distributed through mass spam, this threat is typically deployed in focused attacks against high-value targets—but its techniques have been adopted in broader cybercrime operations that can affect smaller businesses and individuals.
What makes LightlessCan particularly concerning is its ability to mimic legitimate Windows administrative commands internally, allowing attackers to gather system information and execute tasks without triggering the security alerts that normally occur when external command-line tools run. For home users and small business owners in the Roswell area, understanding this threat matters because the techniques pioneered by state-sponsored groups inevitably trickle down to common cybercriminal operations.
Threat Profile
| Characteristic | Details |
|---|---|
| Threat Name | LightlessCan (also tracked as SIDESHOW) |
| Threat Type | Remote Access Trojan (RAT), HTTP/HTTPS backdoor |
| Platform | Windows (all modern versions) |
| File Type | Windows PE (Portable Executable) |
| Attribution | Lazarus Group (North Korean state-sponsored APT) |
| First Observed | Q2 2022 (documented campaigns) |
| Target Profile | Aerospace, technology, defense contractors; expanding to financial services |
| Predecessor Malware | BlindingCan RAT |
| Primary C2 Method | HTTP/HTTPS communication with encrypted payloads |
| Detection Rate | Low (designed for evasion; mimics legitimate system behavior) |
| Persistence Mechanism | Registry Run keys, scheduled tasks, service installation |
| Severity Rating | Critical (complete system control, data exfiltration capabilities) |
How It Spreads
LightlessCan doesn't spread like a worm—it's delivered as part of carefully orchestrated intrusion campaigns. The Lazarus Group typically gains initial access through spear-phishing emails containing malicious documents or links, exploiting trust relationships between organizations, or compromising software supply chains. Once inside a network, the attackers move laterally, deploying LightlessCan on high-value systems where persistent access matters most.
For individual users and small businesses, the threat comes when attackers pivot from their primary target. Managed service providers, vendors to larger organizations, or professionals working from home on corporate networks can become secondary infection points. The malware itself doesn't self-propagate, but the operators behind it actively expand their foothold once they've breached a network perimeter.
Common delivery and distribution methods include:
- Spear-phishing with weaponized documents: Microsoft Office files or PDFs containing macros or exploits that download the payload when opened
- Watering hole attacks: Compromising websites frequently visited by target organizations to serve drive-by downloads
- Supply chain compromise: Injecting malware into legitimate software updates or installer packages
- Credential theft and lateral movement: After compromising one machine through other means, attackers use stolen credentials to manually deploy LightlessCan on additional systems
- Trojanized legitimate tools: Bundling the RAT with genuine administrative utilities or industry-specific software
- Exploitation of VPN and remote access vulnerabilities: Particularly targeting organizations with exposed remote management interfaces
What It Does On Your Machine
Once installed, LightlessCan establishes encrypted communication with command-and-control servers operated by the attackers. The malware's defining feature is its collection of built-in command implementations that replicate the functionality of native Windows tools—ipconfig, netstat, systeminfo, reg, sc, netsh, arp, ping, nslookup, schtasks, and wmic process creation. By implementing these commands internally rather than calling the actual Windows utilities, LightlessCan evades security monitoring systems that watch for suspicious command-line activity.
This approach is devastatingly effective against traditional endpoint protection. When an attacker uses LightlessCan to run a "systeminfo" query, no cmd.exe process spawns, no PowerShell executes, and no suspicious parent-child process relationships appear in logs. From the security software's perspective, it's just the legitimate LightlessCan process (which may be masquerading under a trusted name) performing internal operations. The malware collects the same information a legitimate systeminfo command would gather, but the collection happens entirely within the trojan's own memory space.
Beyond reconnaissance, LightlessCan provides the attackers with comprehensive remote control capabilities inherited from its BlindingCan predecessor: file upload and download, arbitrary command execution (for tasks not covered by the built-in commands), process manipulation, and persistent backdoor access. The HTTP/HTTPS communication protocol allows the malware to blend with legitimate web traffic, often passing through firewalls unchallenged. Attackers can maintain access for months, periodically checking in to steal data, deploy additional tools, or simply maintain a foothold for future operations.
Manual Removal — Step by Step
Isolate the Infected System Immediately
Disconnect the machine from all networks—unplug Ethernet cables and disable WiFi. Do NOT shut down the computer yet, as this may destroy volatile memory evidence. If this is a business machine or contains critical data, photograph the screen and note any visible processes before proceeding. LightlessCan operators may be actively connected; isolation prevents them from destroying evidence or spreading to other systems.
Boot Into Safe Mode with Networking
Restart the computer and press F8 (or Shift+F8 on newer systems) during boot to access Advanced Boot Options. Select "Safe Mode with Networking." This loads only essential drivers and services, preventing most malware from executing normally while still allowing you to download tools if needed. On Windows 10/11, you may need to use Settings > Update & Security > Recovery > Advanced Startup instead.
Identify Suspicious Processes and Services
Open Task Manager (Ctrl+Shift+Esc) and examine running processes carefully. LightlessCan often disguises itself with names like "svchost.exe" or other legitimate-sounding system process names, but the location matters. Right-click suspicious entries and select "Open File Location." Legitimate svchost.exe lives in C:\Windows\System32—anything in AppData, ProgramData, or user directories is suspect. Check the Services tab for unfamiliar entries with generic names.
Remove Persistence Mechanisms
Press Win+R, type "regedit" and hit Enter. Navigate to HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run and HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run. Look for entries you don't recognize, especially those pointing to unusual file paths. Document each suspicious entry (screenshot or write down) before deletion. Also check Task Scheduler (taskschd.msc) for unfamiliar scheduled tasks that launch executables from non-standard locations.
Locate and Delete Malware Files
Using the file locations identified in Step 3, navigate to those directories in File Explorer. Before deleting, note the exact paths and filenames—you'll need this information for verification. Delete the executable files, but be aware that sophisticated malware like LightlessCan may have multiple components. Check common hiding spots: %APPDATA%\Microsoft\Windows\, %PROGRAMDATA%, and %TEMP% directories for unfamiliar folders created recently.
Scan with Multiple Security Tools
Run a full system scan with your existing antivirus if installed, then download and run a second-opinion scanner like Malwarebytes or HitmanPro. Because LightlessCan is designed to evade detection, no single tool catches it reliably. Use at least two different scanning engines. Be prepared for scans to take several hours on larger drives. Do NOT skip this step even if you've manually removed files—remnants and additional payloads often remain.
Check for Additional Compromise Indicators
Open Command Prompt as Administrator and run "netstat -ano" to check for unusual network connections. Examine your browser extensions and installed programs list for anything unfamiliar. Review recent Windows Event Logs (Event Viewer > Windows Logs > Security and System) for failed login attempts or privilege escalation events. Advanced threats often deploy multiple payloads—finding LightlessCan means looking for what else might be present.
Change All Credentials
From a DIFFERENT, clean device, immediately change passwords for all accounts accessed from the infected machine—especially email, banking, work systems, and cloud storage. Enable two-factor authentication everywhere possible. LightlessCan has keylogging and credential-theft capabilities; assume any password typed on the infected machine has been compromised. Contact your IT department if this is a work computer.
Monitor for Re-infection
After removal, watch for signs the malware has returned: unexpected network activity, new unfamiliar processes, or system behavior changes. Keep your security software running and fully updated. Monitor your network router's logs for unusual outbound connections. LightlessCan's operators are persistent—if they've targeted you once, they may try again using different techniques.
Consider Professional Forensic Analysis
For business systems or if you handle sensitive data, manual removal isn't enough. LightlessCan infections often indicate broader network compromise. Professional forensic analysis can identify how the attackers got in, what data they accessed, and whether other systems are affected. Computer Repair Roswell provides this service with proper evidence handling and documentation for insurance or legal purposes.
Prevention
- Implement email security training and filtering: Most LightlessCan infections begin with spear-phishing. Train employees to recognize suspicious emails, verify sender identities through separate channels before opening attachments, and report potential phishing attempts. Deploy email filtering solutions that scan attachments and links before delivery.
- Keep all software rigorously updated: Attackers exploit known vulnerabilities in outdated software to gain initial access. Enable automatic updates for Windows, browsers, and all applications. Pay special attention to VPN clients, remote access tools, and productivity software—these are common entry points.
- Deploy endpoint detection and response (EDR) solutions: Traditional antivirus isn't sufficient against sophisticated threats like LightlessCan. EDR platforms monitor behavioral patterns, process relationships, and anomalous activities that signature-based tools miss. For businesses, this isn't optional—it's essential infrastructure.
- Segment your network properly: Don't allow unrestricted communication between workstations and servers. Implement network segmentation so that compromising one machine doesn't grant access to your entire infrastructure. Use firewalls to control traffic between network zones and restrict outbound connections from workstations to only necessary services.
- Disable macros and script execution by default: Configure Microsoft Office to block macros in documents from the internet. Disable Windows Script Host on systems that don't need it. Require administrator approval for PowerShell script execution. These settings prevent many delivery mechanisms without impacting legitimate business operations.
- Use application whitelisting where feasible: On critical systems, consider allowing only approved applications to execute. This prevents unknown executables like LightlessCan from running even if they bypass other defenses. Modern Windows versions include AppLocker for this purpose.
- Monitor and log command-line activity: While LightlessCan evades this by implementing commands internally, logging all cmd.exe and PowerShell execution across your network helps detect related attack activities and lateral movement attempts. Centralize these logs for analysis.
- Establish an incident response plan before you need it: Document procedures for isolating infected systems, whom to contact, how to preserve evidence, and when to involve law enforcement. For targeted attacks like those deploying LightlessCan, having a plan reduces chaos and prevents costly mistakes during active incidents.
Bring It In
LightlessCan represents a class of threat that goes beyond what typical users can safely handle alone. The manual removal steps above work for straightforward infections, but this malware often coexists with other tools in a broader intrusion campaign. If you're dealing with a business computer, handle sensitive data, or simply want certainty that your system is truly clean, professional assistance isn't a luxury—it's a necessity.
Computer Repair Roswell has handled advanced persistent threats for Roswell-area businesses and residents since 2009. We perform thorough malware analysis, complete system remediation, and network security assessments to ensure threats are fully eliminated—not just hidden. Our shop is located at 470 West Crossville Road, Suite 105, Roswell, GA 30075. Call us at (770) 856-1617 or stop by Monday through Friday, 10 AM to 6 PM. We'll examine your system, explain what we find in plain English, and provide a clear quote before performing any work. When state-sponsored malware techniques reach your doorstep, you want local expertise you can trust.