Cisco Talos describes Operation Blacksmith, a Lazarus/Andariel-linked campaign that opportunistically targeted manufacturing, agriculture, and physical security organizations by exploiting vulnerable infrastructure such as Log4j. The campaign deployed three DLang-based malware families: NineRAT, which uses Telegram bots and channels for command and control, DLRAT, and the BottomLoader downloader. Talos links the activity to North Korea's Lazarus umbrella and notes overlap with Onyx Sleet/Andariel tradecraft, including hands-on-keyboard post-compromise activity and credential collection.