Threat Group Cards: A Threat Actor Encyclopedia
Archived: 2026-04-05 18:57:24 UTC
Home > List all groups > List all tools > List all groups using tool KANDYKORN
 Tool: KANDYKORN
Names KANDYKORN
Category Malware
Type Backdoor, Exfiltration
Description
(Elastic) KANDYKORN is the final stage of this execution chain and possesses a full-featured
set of capabilities to access and exfiltrate data from the victim’s computer. Elastic Security
Labs was able to retrieve this payload from one C2 server which hadn’t been deactivated yet.
Information <https://www.elastic.co/security-labs/elastic-catches-dprk-passing-out-kandykorn>
Malpedia <https://malpedia.caad.fkie.fraunhofer.de/details/osx.kandykorn>
Last change to this tool card: 17 January 2024
Download this tool card in JSON format
All groups using tool KANDYKORN
Changed Name Country Observed
APT groups
  Lazarus Group, Hidden Cobra, Labyrinth Chollima 2007-May 2025
1 group listed (1 APT, 0 other, 0 unknown)
Source: https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=8664953d-3b93-4134-8936-9fdb508474f7
https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=8664953d-3b93-4134-8936-9fdb508474f7
Page 1 of 1