{
	"id": "30715cfb-0cf6-4794-920b-52d904440888",
	"created_at": "2026-04-06T00:16:50.243633Z",
	"updated_at": "2026-04-10T03:38:19.946071Z",
	"deleted_at": null,
	"sha1_hash": "4f64362be8614ec00dffd72e5b5fc8b0954b56db",
	"title": "MAR-10271944-3.v1 – North Korean Trojan: BUFFETLINE | CISA",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 71510,
	"plain_text": "MAR-10271944-3.v1 – North Korean Trojan: BUFFETLINE | CISA\r\nPublished: 2020-02-14 · Archived: 2026-04-05 14:08:46 UTC\r\nNotification\r\nThis report is provided \"as is\" for informational purposes only. The Department of Homeland Security (DHS) does not\r\nprovide any warranties of any kind regarding any information contained herein. The DHS does not endorse any commercial\r\nproduct or service referenced in this bulletin or otherwise.\r\nThis document is marked TLP:WHITE--Disclosure is not limited. Sources may use TLP:WHITE when information carries\r\nminimal or no foreseeable risk of misuse, in accordance with applicable rules and procedures for public release. Subject to\r\nstandard copyright rules, TLP:WHITE information may be distributed without restriction. For more information on the\r\nTraffic Light Protocol (TLP), see http://www.us-cert.gov/tlp.\r\nSummary\r\nDescription\r\nThis Malware Analysis Report (MAR) is the result of analytic efforts between Department of Homeland Security (DHS), the\r\nFederal Bureau of Investigation (FBI), and the Department of Defense (DoD). Working with U.S. Government partners,\r\nDHS, FBI, and DoD identified Trojan malware variants used by the North Korean government. This malware variant has\r\nbeen identified as BUFFETLINE. The U.S. Government refers to malicious cyber activity by the North Korean government\r\nas HIDDEN COBRA. For more information on HIDDEN COBRA activity, visit https[:]//www[.]us-cert.gov/hiddencobra.\r\nDHS, FBI, and DoD are distributing this MAR to enable network defense and reduce exposure to North Korean government\r\nmalicious cyber activity.\r\nThis MAR includes malware descriptions related to HIDDEN COBRA, suggested response actions and recommended\r\nmitigation techniques. Users or administrators should flag activity associated with the malware and report the activity to the\r\nCybersecurity and Infrastructure Security Agency (CISA) or the FBI Cyber Watch (CyWatch), and give the activity the\r\nhighest priority for enhanced mitigation.\r\nThis report looks at a full-featured beaconing implant. This sample uses PolarSSL for session authentication, but then\r\nutilizes a FakeTLS scheme for network encoding using a modified RC4 algorithm. It has the capability to download, upload,\r\ndelete, and execute files; enable Windows CLI access; create and terminate processes; and perform target system\r\nenumeration.\r\nFor a downloadable copy of IOCs, see MAR-10271944-3.v1.stix.\r\nSubmitted Files (1)\r\n52f83cdaefd194fff3d387631d5693a709cd7b3a20a072e7827c4d4218d57695 (smss.exe)\r\nIPs (2)\r\n107.6.12.135\r\n210.202.40.35\r\nFindings\r\n52f83cdaefd194fff3d387631d5693a709cd7b3a20a072e7827c4d4218d57695\r\nTags\r\ntrojan\r\nDetails\r\nName smss.exe\r\nSize 139265 bytes\r\nhttps://www.us-cert.gov/ncas/analysis-reports/ar20-045f\r\nPage 1 of 7\n\nType PE32 executable (GUI) Intel 80386, for MS Windows\r\nMD5 11cb4f1cdd9370162d67945059f70d0d\r\nSHA1 f59c7ce763c4d5717f986e578e3bce8a43f721d2\r\nSHA256 52f83cdaefd194fff3d387631d5693a709cd7b3a20a072e7827c4d4218d57695\r\nSHA512 53c308aa54eed5cf2979d519fc128fcebce8ce425566426086c88e9eb5ebf69c4e40361ebb5df50f98fdf823b0ecf7f1a1736be189db67d566\r\nssdeep 3072:BqrWp5J6z3fNOo7R650dB+0l2pucertVev7:4Wp5J6zP9di2Bt0J\r\nEntropy 6.180760\r\nAntivirus\r\nAhnlab Trojan/Win32.Akdoor\r\nAntiy Trojan/Win32.Agent\r\nAvira TR/NukeSped.dtrpn\r\nBitDefender Trojan.GenericKD.5884300\r\nClamAV Win.Trojan.HiddenCobra-7402602-0\r\nESET a variant of Win32/NukeSped.AU trojan\r\nEmsisoft Trojan.GenericKD.5884300 (B)\r\nFilseclab Trojan.Agent.ikox.sjwn\r\nHuorong Trojan/Generic!6B2189F3963492CB\r\nIkarus Trojan.Win32.NukeSped\r\nK7 Trojan ( 004d07bc1 )\r\nMcAfee GenericRXDC-AJ!11CB4F1CDD93\r\nNANOAV Trojan.Win32.NukeSped.faxfdd\r\nSymantec Trojan.Hoplight\r\nVirusBlokAda BScope.Trojan.Tiggre\r\nZillya! Trojan.Agent.Win32.817728\r\nYARA Rules\r\nrule encodedHandshakeStrings\r\n{\r\n   meta:\r\n       author = \"CISA trusted 3rd party\"\r\n       incident = \"10271944.r3.v1\"\r\n       date =    \"2019-12-25\"\r\n       category = \"Hidden_Cobra\"\r\n       family = \"BUFFETLINE\"\r\n   strings:\r\n       $e1 = { dd 91 4a 1d cb 93 52 0a d0 cb 0a 4c ca d5 08 4b ca 92 4b 1d de 92 4b 1e d2 8b 5c 14 de 92 5c }\r\n       $e2 = { 81 8c 4d 1d d1 8a 52 1d d7 8a 4c 0d 8b c8 01 4c cd 9c 5e 0b dc 97 5e 12 95 cb 4a 48 cf 9c 53 }\r\n   condition:\r\n       (uint16(0) == 0x5A4D and uint16(uint32(0x3c)) == 0x4550) and any of them\r\n}\r\nrule polarsslClientHello\r\n{\r\n   meta:\r\n       author = \"CISA trusted 3rd party\"\r\nhttps://www.us-cert.gov/ncas/analysis-reports/ar20-045f\r\nPage 2 of 7\n\nincident = \"10271944.R3.V1\"\r\n       date =    \"2019-12-25\"\r\n       category = \"Hidden_Cobra\"\r\n       family = \"BUFFETLINE\"\r\n   strings:\r\n       $polarSSL = \"fjiejffndxklfsdkfjsaadiepwn\"\r\n       $cliHello = \"!Q@W#E$R%T^Y\u0026U*I(O)P\"\r\n   condition:\r\n       (uint16(0) == 0x5A4D and uint16(uint32(0x3c)) == 0x4550) and all of them\r\n}\r\nssdeep Matches\r\n100 16c3a7f143e831dd0481d2d57aae885090e22ec55cc8282009f641755d423fcd\r\nPE Metadata\r\nCompile Date 2016-10-03 02:34:09-04:00\r\nImport Hash 6a3547c38d6806b7d5a8b2638621ca32\r\nPE Sections\r\nMD5 Name Raw Size Entropy\r\n83eb1da0a8ab18f046922a558cb8ede6 header 4096 0.676716\r\nb672be56b1bc345710663b196247c46c .text 98304 6.661074\r\n058bc0c9a6ef4120a61e2cb75b7e2825 .rdata 12288 6.220732\r\n1b2e3c963ae327f7f74e13f15a31fa55 .data 20480 2.725473\r\n02bb750555f1c2623effc3aa3d077a34 .rsrc 4096 0.897401\r\nPackers/Compilers/Cryptors\r\nMicrosoft Visual C++ v6.0\r\nRelationships\r\n52f83cdaef... Connected_To 107.6.12.135\r\n52f83cdaef... Connected_To 210.202.40.35\r\nDescription\r\nThe sample performs dynamic DLL importing and API lookups using LoadLibrary and GetProcAddress on obfuscated\r\nstrings in an attempt to hide it’s usage of network functions.\r\nThe sample obfuscates strings used for API lookups as well as the strings used during the network handshake using a\r\nmodified RC4 algorithm. A Python 3 script to decrypt the obfuscated strings is given below. Note: The hardcoded command\r\nand control (C2) IP’s are not obfuscated, but appear in plaintext within the executable.\r\n--Begin Python 3 Decode Script--\r\ndef decode_string(enc, key=0x15b3):\r\n   dec = b''\r\n   sbox = b''\r\n      tmp = ((key + len(enc)) * -0x52) \u0026 0xff    \r\n   for i in range(0x100):\r\n       sbox += bytes([((i + 1) * key * -0x78) \u0026 0xff])\r\nhttps://www.us-cert.gov/ncas/analysis-reports/ar20-045f\r\nPage 3 of 7\n\nfor b in enc:\r\n       dec += bytes([ord(b) ^ sbox[tmp]])\r\n       tmp = (tmp + (key + len(enc)) * 0x7c) \u0026 0xff        \r\n   return dec\r\n--End Python 3 Decode Script--\r\n--Begin C2 IP and Port--\r\n107.6.12.135:443\r\n210.202.40.35:443\r\n--End C2 IP and Port--\r\nThe sample attempts to perform a PolarSSL handshake to initiate a connection to each of these hardcoded C2 IPs using TLS\r\nversion 1.1. It uses the PolarSSL server_name extension with the Server Name set to \"!Q@W#E$R%T^Y\u0026U*I(O)P\". The\r\nPolarSSL certificate and private key are provided below.\r\n--Begin PolarSSL Certificate--\r\n----BEGIN CERTIFICATE-----\r\nMIIDhzCCAm+gAwIBAgIBADANBgkqhkiG9w0BAQUFADA7MQswCQYDVQQGEwJOTDER\r\nMA8GA1UEChMIUG9sYXJTU0wxGTAXBgNVBAMTEFBvbGFyU1NMIFRlc3QgQ0EwHhcN\r\nMTEwMjEyMTQ0NDAwWhcNMjEwMjEyMTQ0NDAwWjA7MQswCQYDVQQGEwJOTDERMA8G\r\nA1UEChMIUG9sYXJTU0wxGTAXBgNVBAMTEFBvbGFyU1NMIFRlc3QgQ0EwggEiMA0G\r\nCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDA3zf8F7vglp0/ht6WMn1EpRagzSHx\r\nmdTs6st8GFgIlKXsm8WL3xoemTiZhx57wI053zhdcHgH057Zk+i5clHFzqMwUqny\r\n50BwFMtEonILwuVA+T7lpg6z+exKY8C4KQB0nFc7qKUEkHHxvYPZP9al4jwqj+8n\r\nYMPGn8u67GB9t+aEMr5P+1gmIgNb1LTV+/Xjli5wwOQuvfwu7uJBVcA0Ln0kcmnL\r\nR7EUQIN9Z/SG9jGr8XmksrUuEvmEF/Bibyc+E1ixVA0hmnM3oTDPb5Lc9un8rNsu\r\nKNF+AksjoBXyOGVkCeoMbo4bF6BxyLObyavpw/LPh5aPgAIynplYb6LVAgMBAAGj\r\ngZUwgZIwDAYDVR0TBAUwAwEB/zAdBgNVHQ4EFgQUtFrkpbPe0lL2udWmlQ/rPrzH\r\n/f8wYwYDVR0jBFwwWoAUtFrkpbPe0lL2udWmlQ/rPrzH/f+hP6Q9MDsxCzAJBgNV\r\nBAYTAk5MMREwDwYDVQQKEwhQb2xhclNTTDEZMBcGA1UEAxMQUG9sYXJTU0wgVGVz\r\ndCBDQYIBADANBgkqhkiG9w0BAQUFAAOCAQEAuP1U2ABUkIslsCfdlc2i94QHHYeJ\r\nSsR4EdgHtdciUI5I62J6Mom+Y0dT/7a+8S6MVMCZP6C5NyNyXw1GWY/YR82XTJ8H\r\nDBJiCTok5DbZ6SzaONBzdWHXwWwmi5vg1dxn7YxrM9d0IjxM27WNKs4sDQhZBQkF\r\npjmfs2cb4oPl4Y9T9meTx/lvdkRYEug61Jfn6cA+qHpyPYdTH+UshITnmp5/Ztkf\r\nm/UTSLBNFNHesiTZeH31NcxYGdHSme9Nc/gfidRa0FLOCfWxRlFqAI47zG9jAQCZ\r\n7Z2mCGDNMhjQc+BYcdnl0lPXjdDK6V0qCg1dVewhUBcW5gZKzV7e9+DpVA==\r\n-----END CERTIFICATE-----\r\n--End PolarSSL Certificate--\r\n--Begin Private Key--\r\n-----BEGIN RSA PRIVATE KEY-----\r\nMIIEpAIBAAKCAQEAyHTEzLn5tXnpRdkUYLB9u5Pyax6fM60Nj4o8VmXl3ETZzGaF\r\nB9X4J7BKNdBjngpuG7fa8H6r7gwQk4ZJGDTzqCrSV/Uu1C93KYRhTYJQj6eVSHD1\r\nbk2y1RPD0hrt5kPqQhTrdOrA7R/UV06p86jt0uDBMHEwMjDV0/YI0FZPRo7yX/k9\r\nZ5GIMC5Cst99++UMd//sMcB4j7/Cf8qtbCHWjdmLao5v4Jv4EFbMs44TFeY0BGbH\r\n7vk2DmqV9gmaBmf0ZXH4yqSxJeD+PIs1BGe64E92hfx//DZrtenNLQNiTrM9AM+v\r\ndqBpVoNq0qjU51Bx5rU2BXcFbXvI5MT9TNUhXwIDAQABAoIBAGdNtfYDiap6bzst\r\nyhCiI8m9TtrhZw4MisaEaN/ll3XSjaOG2dvV6xMZCMV+5TeXDHOAZnY18Yi18vzz\r\n4Ut2TnNFzizCECYNaA2fST3WgInnxUkV3YXAyP6CNxJaCmv2aA0yFr2kFVSeaKGt\r\nymvljNp2NVkvm7Th8fBQBO7I7AXhz43k0mR7XmPgewe8ApZOG3hstkOaMvbWAvWA\r\nzCZupdDjZYjOJqlA4eEA4H8/w7F83r5CugeBE8LgEREjLPiyejrU5H1fubEY+h0d\r\nl5HZBJ68ybTXfQ5U9o/QKA3dd0toBEhhdRUDGzWtjvwkEQfqF1reGWj/tod/gCpf\r\nDFi6X0ECgYEA4wOv/pjSC3ty6TuOvKX2rOUiBrLXXv2JSxZnMoMiWI5ipLQt+RYT\r\nVPafL/m7Dn6MbwjayOkcZhBwk5CNz5A6Q4lJ64Mq/lqHznRCQQ2Mc1G8eyDF/fYL\r\nZe2pLvwP9VD5jTc2miDfw+MnvJhywRRLcemDFP8k4hQVtm8PMp3ZmNECgYEA4gz7\r\nwzObR4gn8ibe617uQPZjWzUj9dUHYd+in1gwBCIrtNnaRn9I9U/Q6tegRYpii4ys\r\nc176NmU+umy6XmuSKV5qD9bSpZWG2nLFnslrN15Lm3fhZxoeMNhBaEDTnLT26yoi\r\n33gp0mSSWy94ZEqipms+ULF6sY1ZtFW6tpGFoy8CgYAQHhnnvJflIs2ky4q10B60\r\nhttps://www.us-cert.gov/ncas/analysis-reports/ar20-045f\r\nPage 4 of 7\n\nZcxFp3rtDpkp0JxhFLhiizFrujMtZSjYNm5U7KkgPVHhLELEUvCmOnKTt4ap/vZ0\r\nBxJNe1GZH3pW6SAvGDQpl9sG7uu/vTFP+lCxukmzxB0DrrDcvorEkKMom7ZCCRvW\r\nKZsZ6YeH2Z81BauRj218kQKBgQCUV/DgKP2985xDTT79N08jUo3hTP5MVYCCuj/+\r\nUeEw1TvZcx3LJby7P6Xad6a1/BqveaGyFKIfEFIaBUBItk801sDDpDaYc4gL00Xc\r\n7lFuBHOZkxJYlss5QrGpuOEl9ZwUt5IrFLBdYaKqNHzNVC1pCPfb/JyH6Dr2HUxq\r\ngxUwAQKBgQCcU6G2L8AG9d9c0UpOyL1tMvFe5Ttw0KjlQVdsh1MP6yigYo9DYuwu\r\nbHFVW2r0dBTqegP2/KTOxKzaHfC1qf0RGDsUoJCNJrd1cwoCLG8P2EF4w3OBrKqv\r\n8u4ytY0F+Vlanj5lm3TaoHSVF1+NWPyOTiwevIECGKwSxvlki4fDAA==\r\n-----END RSA PRIVATE KEY-----\r\n--End Private Key--\r\nAfter the TLS authentication is completed this particular sample does NOT use the session key that is generated via TLS.\r\nInstead, it uses a FakeTLS scheme, where a 'fake' TLS packet header is prepended to the packet data which is encrypted\r\nwith custom xor encryption scheme. The FakeTLS packet format and a Python 3 script to decrypt network traffic is given\r\nbelow.\r\n--Begin FakeTLS Packet Structure--\r\n17 03 02 \u003c2 Byte data length\u003e \u003c4 Byte Key\u003e \u003cdata\u003e\r\n--End Fake TLS Packet Structure--\r\nNote: Each \"Key\" is generated by the sender rand( ).\r\n--Begin Python 3 Network Communication Decode Script--\r\ndef decode_pkt(enc, key):\r\n   dec = b''\r\n   sbox = b''\r\n   addVal = len(enc) * key \u0026 0xff    \r\n   for i in range(0x100):\r\n       sbox += bytes([((i + 1) * key) \u0026 0xff])\r\n          indexVal = addVal;\r\n   for b in enc:\r\n       dec += bytes([b ^ sbox[indexVal]])\r\n       indexVal = indexVal + addVal \u0026 0xff;        \r\n   return dec\r\n--End Python 3 Network Communication Decode Script--\r\nAfter the TLS authentication, the sample performs a handshake with the C2, where hardcoded 32 Byte strings are\r\nexchanged, as well as a Victim ID and the Victim Internal IP. After this exchange, the implant sends it’s Victim Information\r\n(Figure 2), and then waits for tasking from the C2.\r\nScreenshots\r\nFigure 1 - Configuration Structure.\r\nFigure 2 - Victim Information Structure.\r\nFigure 3 - Implant Functionality.\r\nFigure 4 - Session Structure.\r\n107.6.12.135\r\nTags\r\ncommand-and-control\r\nPorts\r\n443 TCP\r\nhttps://www.us-cert.gov/ncas/analysis-reports/ar20-045f\r\nPage 5 of 7\n\nRelationships\r\n107.6.12.135 Connected_From 52f83cdaefd194fff3d387631d5693a709cd7b3a20a072e7827c4d4218d57695\r\nDescription\r\nHardcoded C2 IP.\r\n210.202.40.35\r\nTags\r\ncommand-and-control\r\nPorts\r\n443 TCP\r\nRelationships\r\n210.202.40.35 Connected_From 52f83cdaefd194fff3d387631d5693a709cd7b3a20a072e7827c4d4218d57695\r\nDescription\r\nHardcoded C2 IP.\r\nRelationship Summary\r\n52f83cdaef... Connected_To 107.6.12.135\r\n52f83cdaef... Connected_To 210.202.40.35\r\n107.6.12.135 Connected_From 52f83cdaefd194fff3d387631d5693a709cd7b3a20a072e7827c4d4218d57695\r\n210.202.40.35 Connected_From 52f83cdaefd194fff3d387631d5693a709cd7b3a20a072e7827c4d4218d57695\r\nMitigation\r\n// The following Snort rule can be used to detect the FakeTLS handshake packets by targeting to a\r\n// logical inconsistency in the appdata packet sizes due to the inclusion of the 4 Byte decode key\r\n// before the data, but not being included in the data length.\r\nalert tcp any any -\u003e any any (msg:\"Malware Detected\"; content:\"PolarSSL\"; pcre:\"/ \\x17\\x03\\x02\\x00\\x23.\r\n{39}\\x17\\x03\\x02/\"; rev:1; sid:99999999;)\r\nRecommendations\r\nCISA recommends that users and administrators consider using the following best practices to strengthen the security\r\nposture of their organization's systems. Any configuration changes should be reviewed by system owners and administrators\r\nprior to implementation to avoid unwanted impacts.\r\nMaintain up-to-date antivirus signatures and engines.\r\nKeep operating system patches up-to-date.\r\nDisable File and Printer sharing services. If these services are required, use strong passwords or Active Directory\r\nauthentication.\r\nRestrict users' ability (permissions) to install and run unwanted software applications. Do not add users to the local\r\nadministrators group unless required.\r\nEnforce a strong password policy and implement regular password changes.\r\nExercise caution when opening e-mail attachments even if the attachment is expected and the sender appears to be\r\nknown.\r\nEnable a personal firewall on agency workstations, configured to deny unsolicited connection requests.\r\nDisable unnecessary services on agency workstations and servers.\r\nScan for and remove suspicious e-mail attachments; ensure the scanned attachment is its \"true file type\" (i.e., the\r\nextension matches the file header).\r\nhttps://www.us-cert.gov/ncas/analysis-reports/ar20-045f\r\nPage 6 of 7\n\nMonitor users' web browsing habits; restrict access to sites with unfavorable content.\r\nExercise caution when using removable media (e.g., USB thumb drives, external drives, CDs, etc.).\r\nScan all software downloaded from the Internet prior to executing.\r\nMaintain situational awareness of the latest threats and implement appropriate Access Control Lists (ACLs).\r\nAdditional information on malware incident prevention and handling can be found in National Institute of Standards and\r\nTechnology (NIST) Special Publication 800-83, \"Guide to Malware Incident Prevention \u0026 Handling for Desktops and\r\nLaptops\".\r\nContact Information\r\nDocument FAQ\r\nWhat is a MIFR? A Malware Initial Findings Report (MIFR) is intended to provide organizations with malware analysis in\r\na timely manner. In most instances this report will provide initial indicators for computer and network defense. To request\r\nadditional analysis, please contact CISA and provide information regarding the level of desired analysis.\r\nWhat is a MAR? A Malware Analysis Report (MAR) is intended to provide organizations with more detailed malware\r\nanalysis acquired via manual reverse engineering. To request additional analysis, please contact CISA and provide\r\ninformation regarding the level of desired analysis.\r\nCan I edit this document? This document is not to be edited in any way by recipients. All comments or questions related to\r\nthis document should be directed to the CISA at 1-844-Say-CISA or contact@mail.cisa.dhs.gov .\r\nCan I submit malware to CISA? Malware samples can be submitted via three methods:\r\nWeb: https://malware.us-cert.gov\r\nE-Mail: submit@malware.us-cert.gov\r\nFTP: ftp.malware.us-cert.gov (anonymous)\r\nCISA encourages you to report any suspicious activity, including cybersecurity incidents, possible malicious code, software\r\nvulnerabilities, and phishing-related scams. Reporting forms can be found on CISA's homepage at www.us-cert.gov.\r\nSource: https://www.us-cert.gov/ncas/analysis-reports/ar20-045f\r\nhttps://www.us-cert.gov/ncas/analysis-reports/ar20-045f\r\nPage 7 of 7",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"Malpedia",
		"ETDA"
	],
	"references": [
		"https://www.us-cert.gov/ncas/analysis-reports/ar20-045f"
	],
	"report_names": [
		"ar20-045f"
	],
	"threat_actors": [
		{
			"id": "34eea331-d052-4096-ae03-a22f1d090bd4",
			"created_at": "2025-08-07T02:03:25.073494Z",
			"updated_at": "2026-04-10T02:00:03.709243Z",
			"deleted_at": null,
			"main_name": "NICKEL ACADEMY",
			"aliases": [
				"ATK3 ",
				"Black Artemis ",
				"COVELLITE ",
				"CTG-2460 ",
				"Citrine Sleet ",
				"Diamond Sleet ",
				"Guardians of Peace",
				"HIDDEN COBRA ",
				"High Anonymous",
				"Labyrinth Chollima ",
				"Lazarus Group ",
				"NNPT Group",
				"New Romanic Cyber Army Team",
				"Temp.Hermit ",
				"UNC577 ",
				"Who Am I?",
				"Whois Team",
				"ZINC "
			],
			"source_name": "Secureworks:NICKEL ACADEMY",
			"tools": [
				"Destover",
				"KorHigh",
				"Volgmer"
			],
			"source_id": "Secureworks",
			"reports": null
		},
		{
			"id": "732597b1-40a8-474c-88cc-eb8a421c29f1",
			"created_at": "2025-08-07T02:03:25.087732Z",
			"updated_at": "2026-04-10T02:00:03.776007Z",
			"deleted_at": null,
			"main_name": "NICKEL GLADSTONE",
			"aliases": [
				"APT38 ",
				"ATK 117 ",
				"Alluring Pisces ",
				"Black Alicanto ",
				"Bluenoroff ",
				"CTG-6459 ",
				"Citrine Sleet ",
				"HIDDEN COBRA ",
				"Lazarus Group",
				"Sapphire Sleet ",
				"Selective Pisces ",
				"Stardust Chollima ",
				"T-APT-15 ",
				"TA444 ",
				"TAG-71 "
			],
			"source_name": "Secureworks:NICKEL GLADSTONE",
			"tools": [
				"AlphaNC",
				"Bankshot",
				"CCGC_Proxy",
				"Ratankba",
				"RustBucket",
				"SUGARLOADER",
				"SwiftLoader",
				"Wcry"
			],
			"source_id": "Secureworks",
			"reports": null
		},
		{
			"id": "a2b92056-9378-4749-926b-7e10c4500dac",
			"created_at": "2023-01-06T13:46:38.430595Z",
			"updated_at": "2026-04-10T02:00:02.971571Z",
			"deleted_at": null,
			"main_name": "Lazarus Group",
			"aliases": [
				"Operation DarkSeoul",
				"Bureau 121",
				"Group 77",
				"APT38",
				"NICKEL GLADSTONE",
				"G0082",
				"COPERNICIUM",
				"Moonstone Sleet",
				"Operation GhostSecret",
				"APT 38",
				"Appleworm",
				"Unit 121",
				"ATK3",
				"G0032",
				"ATK117",
				"NewRomanic Cyber Army Team",
				"Nickel Academy",
				"Sapphire Sleet",
				"Lazarus group",
				"Hastati Group",
				"Subgroup: Bluenoroff",
				"Operation Troy",
				"Black Artemis",
				"Dark Seoul",
				"Andariel",
				"Labyrinth Chollima",
				"Operation AppleJeus",
				"COVELLITE",
				"Citrine Sleet",
				"DEV-0139",
				"DEV-1222",
				"Hidden Cobra",
				"Bluenoroff",
				"Stardust Chollima",
				"Whois Hacking Team",
				"Diamond Sleet",
				"TA404",
				"BeagleBoyz",
				"APT-C-26"
			],
			"source_name": "MISPGALAXY:Lazarus Group",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "32a223a8-3c79-4146-87c5-8557d38662ae",
			"created_at": "2022-10-25T15:50:23.703698Z",
			"updated_at": "2026-04-10T02:00:05.261989Z",
			"deleted_at": null,
			"main_name": "Lazarus Group",
			"aliases": [
				"Lazarus Group",
				"Labyrinth Chollima",
				"HIDDEN COBRA",
				"Guardians of Peace",
				"NICKEL ACADEMY",
				"Diamond Sleet"
			],
			"source_name": "MITRE:Lazarus Group",
			"tools": [
				"RawDisk",
				"Proxysvc",
				"BADCALL",
				"FALLCHILL",
				"WannaCry",
				"MagicRAT",
				"HOPLIGHT",
				"TYPEFRAME",
				"Dtrack",
				"HotCroissant",
				"HARDRAIN",
				"Dacls",
				"KEYMARBLE",
				"TAINTEDSCRIBE",
				"AuditCred",
				"netsh",
				"ECCENTRICBANDWAGON",
				"AppleJeus",
				"BLINDINGCAN",
				"ThreatNeedle",
				"Volgmer",
				"Cryptoistic",
				"RATANKBA",
				"Bankshot"
			],
			"source_id": "MITRE",
			"reports": null
		},
		{
			"id": "f32df445-9fb4-4234-99e0-3561f6498e4e",
			"created_at": "2022-10-25T16:07:23.756373Z",
			"updated_at": "2026-04-10T02:00:04.739611Z",
			"deleted_at": null,
			"main_name": "Lazarus Group",
			"aliases": [
				"APT-C-26",
				"ATK 3",
				"Appleworm",
				"Citrine Sleet",
				"DEV-0139",
				"Diamond Sleet",
				"G0032",
				"Gleaming Pisces",
				"Gods Apostles",
				"Gods Disciples",
				"Group 77",
				"Guardians of Peace",
				"Hastati Group",
				"Hidden Cobra",
				"ITG03",
				"Jade Sleet",
				"Labyrinth Chollima",
				"Lazarus Group",
				"NewRomanic Cyber Army Team",
				"Operation 99",
				"Operation AppleJeus",
				"Operation AppleJeus sequel",
				"Operation Blockbuster: Breach of Sony Pictures Entertainment",
				"Operation CryptoCore",
				"Operation Dream Job",
				"Operation Dream Magic",
				"Operation Flame",
				"Operation GhostSecret",
				"Operation In(ter)caption",
				"Operation LolZarus",
				"Operation Marstech Mayhem",
				"Operation No Pineapple!",
				"Operation North Star",
				"Operation Phantom Circuit",
				"Operation Sharpshooter",
				"Operation SyncHole",
				"Operation Ten Days of Rain / DarkSeoul",
				"Operation Troy",
				"SectorA01",
				"Slow Pisces",
				"TA404",
				"TraderTraitor",
				"UNC2970",
				"UNC4034",
				"UNC4736",
				"UNC4899",
				"UNC577",
				"Whois Hacking Team"
			],
			"source_name": "ETDA:Lazarus Group",
			"tools": [
				"3CX Backdoor",
				"3Rat Client",
				"3proxy",
				"AIRDRY",
				"ARTFULPIE",
				"ATMDtrack",
				"AlphaNC",
				"Alreay",
				"Andaratm",
				"AngryRebel",
				"AppleJeus",
				"Aryan",
				"AuditCred",
				"BADCALL",
				"BISTROMATH",
				"BLINDINGCAN",
				"BTC Changer",
				"BUFFETLINE",
				"BanSwift",
				"Bankshot",
				"Bitrep",
				"Bitsran",
				"BlindToad",
				"Bookcode",
				"BootWreck",
				"BottomLoader",
				"Brambul",
				"BravoNC",
				"Breut",
				"COLDCAT",
				"COPPERHEDGE",
				"CROWDEDFLOUNDER",
				"Castov",
				"CheeseTray",
				"CleanToad",
				"ClientTraficForwarder",
				"CollectionRAT",
				"Concealment Troy",
				"Contopee",
				"CookieTime",
				"Cyruslish",
				"DAVESHELL",
				"DBLL Dropper",
				"DLRAT",
				"DRATzarus",
				"DRATzarus RAT",
				"Dacls",
				"Dacls RAT",
				"DarkComet",
				"DarkKomet",
				"DeltaCharlie",
				"DeltaNC",
				"Dembr",
				"Destover",
				"DoublePulsar",
				"Dozer",
				"Dtrack",
				"Duuzer",
				"DyePack",
				"ECCENTRICBANDWAGON",
				"ELECTRICFISH",
				"Escad",
				"EternalBlue",
				"FALLCHILL",
				"FYNLOS",
				"FallChill RAT",
				"Farfli",
				"Fimlis",
				"FoggyBrass",
				"FudModule",
				"Fynloski",
				"Gh0st RAT",
				"Ghost RAT",
				"Gopuram",
				"HARDRAIN",
				"HIDDEN COBRA RAT/Worm",
				"HLOADER",
				"HOOKSHOT",
				"HOPLIGHT",
				"HOTCROISSANT",
				"HOTWAX",
				"HTTP Troy",
				"Hawup",
				"Hawup RAT",
				"Hermes",
				"HotCroissant",
				"HotelAlfa",
				"Hotwax",
				"HtDnDownLoader",
				"Http Dr0pper",
				"ICONICSTEALER",
				"Joanap",
				"Jokra",
				"KANDYKORN",
				"KEYMARBLE",
				"Kaos",
				"KillDisk",
				"KillMBR",
				"Koredos",
				"Krademok",
				"LIGHTSHIFT",
				"LIGHTSHOW",
				"LOLBAS",
				"LOLBins",
				"Lazarus",
				"LightlessCan",
				"Living off the Land",
				"MATA",
				"MBRkiller",
				"MagicRAT",
				"Manuscrypt",
				"Mimail",
				"Mimikatz",
				"Moudour",
				"Mydoom",
				"Mydoor",
				"Mytob",
				"NACHOCHEESE",
				"NachoCheese",
				"NestEgg",
				"NickelLoader",
				"NineRAT",
				"Novarg",
				"NukeSped",
				"OpBlockBuster",
				"PCRat",
				"PEBBLEDASH",
				"PLANKWALK",
				"POOLRAT",
				"PSLogger",
				"PhanDoor",
				"Plink",
				"PondRAT",
				"PowerBrace",
				"PowerRatankba",
				"PowerShell RAT",
				"PowerSpritz",
				"PowerTask",
				"Preft",
				"ProcDump",
				"Proxysvc",
				"PuTTY Link",
				"QUICKRIDE",
				"QUICKRIDE.POWER",
				"Quickcafe",
				"QuiteRAT",
				"R-C1",
				"ROptimizer",
				"Ratabanka",
				"RatabankaPOS",
				"Ratankba",
				"RatankbaPOS",
				"RawDisk",
				"RedShawl",
				"Rifdoor",
				"Rising Sun",
				"Romeo-CoreOne",
				"RomeoAlfa",
				"RomeoBravo",
				"RomeoCharlie",
				"RomeoCore",
				"RomeoDelta",
				"RomeoEcho",
				"RomeoFoxtrot",
				"RomeoGolf",
				"RomeoHotel",
				"RomeoMike",
				"RomeoNovember",
				"RomeoWhiskey",
				"Romeos",
				"RustBucket",
				"SHADYCAT",
				"SHARPKNOT",
				"SIGFLIP",
				"SIMPLESEA",
				"SLICKSHOES",
				"SORRYBRUTE",
				"SUDDENICON",
				"SUGARLOADER",
				"SheepRAT",
				"SierraAlfa",
				"SierraBravo",
				"SierraCharlie",
				"SierraJuliett-MikeOne",
				"SierraJuliett-MikeTwo",
				"SimpleTea",
				"SimplexTea",
				"SmallTiger",
				"Stunnel",
				"TAINTEDSCRIBE",
				"TAXHAUL",
				"TFlower",
				"TOUCHKEY",
				"TOUCHMOVE",
				"TOUCHSHIFT",
				"TOUCHSHOT",
				"TWOPENCE",
				"TYPEFRAME",
				"Tdrop",
				"Tdrop2",
				"ThreatNeedle",
				"Tiger RAT",
				"TigerRAT",
				"Trojan Manuscript",
				"Troy",
				"TroyRAT",
				"VEILEDSIGNAL",
				"VHD",
				"VHD Ransomware",
				"VIVACIOUSGIFT",
				"VSingle",
				"ValeforBeta",
				"Volgmer",
				"Vyveva",
				"W1_RAT",
				"Wana Decrypt0r",
				"WanaCry",
				"WanaCrypt",
				"WanaCrypt0r",
				"WannaCry",
				"WannaCrypt",
				"WannaCryptor",
				"WbBot",
				"Wcry",
				"Win32/KillDisk.NBB",
				"Win32/KillDisk.NBC",
				"Win32/KillDisk.NBD",
				"Win32/KillDisk.NBH",
				"Win32/KillDisk.NBI",
				"WinorDLL64",
				"Winsec",
				"WolfRAT",
				"Wormhole",
				"YamaBot",
				"Yort",
				"ZetaNile",
				"concealment_troy",
				"http_troy",
				"httpdr0pper",
				"httpdropper",
				"klovbot",
				"sRDI"
			],
			"source_id": "ETDA",
			"reports": null
		}
	],
	"ts_created_at": 1775434610,
	"ts_updated_at": 1775792299,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/4f64362be8614ec00dffd72e5b5fc8b0954b56db.pdf",
		"text": "https://archive.orkl.eu/4f64362be8614ec00dffd72e5b5fc8b0954b56db.txt",
		"img": "https://archive.orkl.eu/4f64362be8614ec00dffd72e5b5fc8b0954b56db.jpg"
	}
}