Threat Group Cards: A Threat Actor Encyclopedia Archived: 2026-04-05 18:19:35 UTC Home > List all groups > List all tools > List all groups using tool Contopee Tool: Contopee Names Contopee WHITEOUT Category Malware Type Backdoor Description (SecurityWeek) Aside from commonalities in the tools used to spread WannaCry, there are also a number of links between WannaCry itself and Lazarus. The ransomware shares some code with Backdoor.Contopee, malware that has previously been linked to Lazarus. One variant of Contopee uses a custom SSL implementation, with an identical cipher suite, which is also used by WannaCry. The cipher suite in both samples has the same set of 75 different ciphers to choose from (as opposed to OpenSSL where there are over 300). Information Malpedia Last change to this tool card: 23 April 2020 Download this tool card in JSON format All groups using tool Contopee Changed Name Country Observed APT groups   Lazarus Group, Hidden Cobra, Labyrinth Chollima 2007-May 2025 1 group listed (1 APT, 0 other, 0 unknown) https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=673de8e6-d8c0-4a01-882d-91f2007c751a Page 1 of 2 Source: https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=673de8e6-d8c0-4a01-882d-91f2007c751a https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=673de8e6-d8c0-4a01-882d-91f2007c751a Page 2 of 2 APT groups Lazarus Group, Hidden Cobra, Labyrinth Chollima 2007-May 2025 1 group listed (1 APT, 0 other, 0 unknown) Page 1 of 2