Threat Group Cards: A Threat Actor Encyclopedia
Archived: 2026-04-05 16:26:55 UTC
Home > List all groups > List all tools > List all groups using tool HARDRAIN
 Tool: HARDRAIN
Names HARDRAIN
Category Malware
Type Backdoor, Tunneling
Description
(US-CERT) This report provides analysis of three (3) malicious executable files. The
first two (2) files are 32-bit Windows executables that function as Proxy servers and
implement a 'Fake TLS' method similar to the behavior described in a previously
published NCCIC report, MAR-10135536-B. The third file is an Executable Linkable
Format (ELF) file designed to run on Android platforms as a fully functioning Remote
Access Tool (RAT).
Information MITRE ATT&CK Malpedia
AlienVault OTX Last change to this tool card: 22 April 2020
Download this tool card in JSON format
All groups using tool HARDRAIN
Changed Name Country Observed
APT groups
 Lazarus Group, Hidden Cobra, Labyrinth Chollima 2007-May 2025
1 group listed (1 APT, 0 other, 0 unknown)
https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=c8c2fb9c-d95d-4af7-9b76-bb911985b367
Page 1 of 2

Source: https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=c8c2fb9c-d95d-4af7-9b76-bb911985b367
https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=c8c2fb9c-d95d-4af7-9b76-bb911985b367
Page 2 of 2

APT groups Lazarus Group, Hidden Cobra, Labyrinth Chollima 2007-May 2025
1 group listed (1 APT, 0 other, 0 unknown) 
   Page 1 of 2