Threat Group Cards: A Threat Actor Encyclopedia
Archived: 2026-04-05 22:05:16 UTC
Home > List all groups > List all tools > List all groups using tool HOTCROISSANT
 Tool: HOTCROISSANT
Names
HOTCROISSANT
HotCroissant
Category Malware
Type Reconnaissance, Backdoor, Info stealer
Description
(US-CERT) This report looks at a full-featured beaconing implant. This sample
performs a custom XOR network encoding and is capable of many features including
conducting system surveys, file upload/download, process and command execution, and
performing screen captures.
Information
MITRE ATT&CK Malpedia AlienVault OTX Last change to this tool card: 30 December 2022
Download this tool card in JSON format
All groups using tool HOTCROISSANT
Changed Name Country Observed
APT groups
 Lazarus Group, Hidden Cobra, Labyrinth Chollima 2007-May 2025
1 group listed (1 APT, 0 other, 0 unknown)
https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=4d29bfd4-846b-4459-88ca-699f6537a528
Page 1 of 2

Source: https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=4d29bfd4-846b-4459-88ca-699f6537a528
https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=4d29bfd4-846b-4459-88ca-699f6537a528
Page 2 of 2

APT groups Lazarus Group, Hidden Cobra, Labyrinth Chollima 2007-May 2025
1 group listed (1 APT, 0 other, 0 unknown) 
   Page 1 of 2