{ "id": "1e69464f-d4b2-4741-bbd1-69f58f43bfa9", "created_at": "2026-04-06T01:29:38.954292Z", "updated_at": "2026-04-10T13:12:17.4642Z", "deleted_at": null, "sha1_hash": "c83acffac6803f5a3cd8ac669b3ef15827aff676", "title": "MAR-10288834-2.v1 – North Korean Trojan: TAINTEDSCRIBE | CISA", "llm_title": "", "authors": "", "file_creation_date": "0001-01-01T00:00:00Z", "file_modification_date": "0001-01-01T00:00:00Z", "file_size": 72913, "plain_text": "MAR-10288834-2.v1 – North Korean Trojan: TAINTEDSCRIBE | CISA\r\nPublished: 2020-05-12 · Archived: 2026-04-06 00:20:11 UTC\r\nNotification\r\nThis report is provided \"as is\" for informational purposes only. The Department of Homeland Security (DHS) does not\r\nprovide any warranties of any kind regarding any information contained herein. The DHS does not endorse any commercial\r\nproduct or service referenced in this bulletin or otherwise.\r\nThis document is marked TLP:WHITE--Disclosure is not limited. Sources may use TLP:WHITE when information carries\r\nminimal or no foreseeable risk of misuse, in accordance with applicable rules and procedures for public release. Subject to\r\nstandard copyright rules, TLP:WHITE information may be distributed without restriction. For more information on the\r\nTraffic Light Protocol (TLP), see http://www.us-cert.gov/tlp.\r\nSummary\r\nDescription\r\nThis Malware Analysis Report (MAR) is the result of analytic efforts between the Department of Homeland Security (DHS),\r\nthe Federal Bureau of Investigation (FBI), and the Department of Defense (DoD). Working with U.S. Government partners,\r\nDHS, FBI, and DoD identified Trojan malware variants used by the North Korean government. This malware variant has\r\nbeen identified as TAINTEDSCRIBE. The U.S. Government refers to malicious cyber activity by the North Korean\r\ngovernment as HIDDEN COBRA. For more information on HIDDEN COBRA activity, visit https[:]//www[.]us-cert.gov/hiddencobra.\r\nFBI has high confidence that HIDDEN COBRA actors are using malware variants in conjunction with proxy servers to\r\nmaintain a presence on victim networks and to further network exploitation. DHS, FBI, and DoD are distributing this MAR\r\nto enable network defense and reduce exposure to North Korean government malicious cyber activity.\r\nThis MAR includes malware descriptions related to HIDDEN COBRA, suggested response actions and recommended\r\nmitigation techniques. Users or administrators should flag activity associated with the malware and report the activity to the\r\nCybersecurity and Infrastructure Security Agency (CISA) or the FBI Cyber Watch (CyWatch), and give the activity the\r\nhighest priority for enhanced mitigation.\r\nThis report looks at a full-featured beaconing implant and its command modules. These samples uses FakeTLS for session\r\nauthentication and for network encryption utilizing a Linear Feedback Shift Register (LFSR) algorithm. The main\r\nexecutable disguises itself as Microsoft’s Narrator. It downloads its command execution module from a command and\r\ncontrol (C2) server and then has the capability to download, upload, delete, and execute files; enable Windows CLI access;\r\ncreate and terminate processes; and perform target system enumeration.\r\nFor a downloadable copy of IOCs, see MAR-10288834-2.v1.stix.\r\nSubmitted Files (3)\r\n106d915db61436b1a686b86980d4af16227776fc2048f2888995326db0541438 (Narrator.exe)\r\n19f9a9f7a0c3e6ca72ea88c655b6500f7da203d46f38076e6e8de0d644a86e35 (EngineDll.dll)\r\n2057c0cf4617eab7c91b99975dfb1e259609c4fa512e9e08a311a9a2eb65a6cf (EngineDll.dll)\r\nIPs (1)\r\n211.192.239.232\r\nFindings\r\n106d915db61436b1a686b86980d4af16227776fc2048f2888995326db0541438\r\nTags\r\ntrojan\r\nDetails\r\nhttps://us-cert.cisa.gov/ncas/analysis-reports/ar20-133b\r\nPage 1 of 8\n\nName Narrator.exe\r\nSize 286720 bytes\r\nType PE32 executable (GUI) Intel 80386, for MS Windows\r\nMD5 24906e88a757cb535eb17e6c190f371f\r\nSHA1 bda6c036fe34dda6aea7797551c7853a9891de96\r\nSHA256 106d915db61436b1a686b86980d4af16227776fc2048f2888995326db0541438\r\nSHA512 b02f86d8261875c9eaf2ee9d491bc7a5ed3227c90854060078598a7425b58d096398315144517a9daec6cb3542fe901af434b597692963de\r\nssdeep 3072:qKhnf91e3YGs53EeY9eDUSGPGrdj+MieMUgUo2n6/rZDS35bb3tiWh6f9FKi4Z+J:xWvsN/Y9eDpjnieMB2BFtQFgZKUV\r\nEntropy 6.553050\r\nAntivirus\r\nAegisLab Trojan.Win32.Generic.mmcn\r\nAhnlab Trojan/Win32.Agent\r\nAntiy Trojan/Win32.Wacatac\r\nAvira TR/RedCap.ihekz\r\nBitDefender Trojan.GenericKD.32212178\r\nCyren W32/Agent.XH.gen!Eldorado\r\nESET a variant of Win32/NukeSped.CO trojan\r\nEmsisoft Trojan.GenericKD.32212178 (B)\r\nNANOAV Trojan.Win32.NukeSped.fuwevb\r\nVirusBlokAda BScope.Trojan.Win64.AllStars\r\nZillya! Trojan.Generic.Win32.918308\r\nYARA Rules\r\nrule CISA_3P_10135536_36 : lfsrPolynomials_handshakeBytes\r\n{\r\n   meta:\r\n       Author = \"CISA Trusted Third Party\"\r\n       Incident = \"10135536\"\r\n       Date = \"2019-12-20\"\r\n       Actor = \"Hidden Cobra\"\r\n       Category = \"n/a\"\r\n       Family = \"n/a\"\r\n       Description = \"Detects LFSR polynomials used for FakeTLS comms and the bytes exchanged after the FakeTLS\r\nhandshake\"\r\n       MD5_1 = \"24906e88a757cb535eb17e6c190f371f\"\r\n       SHA256_1 = \"106d915db61436b1a686b86980d4af16227776fc2048f2888995326db0541438\"\r\n   strings:\r\n       $p1 = { 01 23 45 67 }\r\n       $p2 = { 89 AB CD EF }\r\n       $p3 = { FE DC BA 98 }\r\n       $p4 = { 76 54 32 10 }\r\n       $h1 = { 44 33 22 11 }\r\n       $h2 = { 45 33 22 11 }\r\n   condition:\r\n       (uint16(0) == 0x5A4D and uint16(uint32(0x3c)) == 0x4550) and all of them\r\n}\r\nhttps://us-cert.cisa.gov/ncas/analysis-reports/ar20-133b\r\nPage 2 of 8\n\nssdeep Matches\r\nNo matches found.\r\nPE Metadata\r\nCompile Date 2018-07-31 21:47:58-04:00\r\nImport Hash 8222381c21809ba71801ba1e0290adcc\r\nCompany Name Microsoft Corporation\r\nFile Description Screen Reader\r\nInternal Name SR.exe\r\nLegal Copyright © Microsoft Corporation. All rights reserved.\r\nOriginal Filename SR.exe\r\nProduct Name Microsoft® Windows® Operating System\r\nProduct Version 6.3.9600.17415\r\nPE Sections\r\nMD5 Name Raw Size Entropy\r\n05cafd41e93a7bd6aa578e957e7c0b4f header 1024 2.508565\r\na6c7082567c2424071bfda7ab3bd8095 .text 144384 6.231730\r\nedd9ce426d2be22871091e1c979b8f94 .rdata 37376 4.515794\r\n3a129f29c07cc0ec4bb30fc7b4fb51e5 .data 4608 2.451992\r\n0674e93d57aa4e7727acc7bdbc37bb36 .rsrc 86016 7.119585\r\n978e1e848b291daef77e403a94cf8497 .reloc 13312 4.524800\r\nRelationships\r\n106d915db6... Downloaded 2057c0cf4617eab7c91b99975dfb1e259609c4fa512e9e08a311a9a2eb65a6cf\r\n106d915db6... Downloaded 19f9a9f7a0c3e6ca72ea88c655b6500f7da203d46f38076e6e8de0d644a86e35\r\n106d915db6... Connected_To 211.192.239.232\r\nDescription\r\nThis file is the main implant executable. For persistence, when executed the malware copies itself into the current user’s\r\nStartup folder as “Narrator.exe”. The malware can have 5 hard-corded callback IP addresses/Ports. However, only 2 IP\r\naddresses are set, both to 211.192.239.232:8443. It will randomly pick one of the 5 IP addresses and attempt to connect to it.\r\nIf it fails, it will wait 60 seconds and then try another IP address.\r\nIt performs the connection and authentication, then it attempts to download an additional module\r\n(3005f1308e4519477ac25d7bbf054899 or 68fa29a40f64c9594cc3dbe8649f9ebc) from the C2, which it loads and uses for\r\ncommand processing.\r\nThe modules export a function, CreateFileProcEx or CreateFileEx. The function is called by this sample with a number of\r\narguments, including a handle to the active connection socket.\r\nThe malware utilizes a “FakeTLS” scheme in an attempt to obfuscate its network communications. It picks a random URL\r\nfrom a list (Figure 1) to use in the TLS certificate. The sample and the C2 externally appear to perform a standard TLS\r\nauthentication, however, most of the fields used are filled with random data sourced from rand().\r\nOnce the FakeTLS handshake is complete, all further packets use a FakeTLS header, followed by LFSR encrypted data.\r\nhttps://us-cert.cisa.gov/ncas/analysis-reports/ar20-133b\r\nPage 3 of 8\n\n--Begin packet structure--\r\n17 03 01 \u003c2 Byte data length\u003e \u003cLFSR encrypted data\u003e\r\n--End packet structure--\r\nAfter the TLS authentication, the sample performs a handshake with the C2 (outlined in Figure 2). After this exchange, the\r\nimplant sends the Victim Info (outlined in Figure 3), and then waits for tasking from the C2.\r\nScreenshots\r\nFigure 1 - List of certificate URLs used in the TLS certificate.\r\nFigure 2 - Table of the session structure.\r\nFigure 3 - Table of the victim information structure.\r\nFigure 4 - The implant contains the commands displayed in the table.\r\n2057c0cf4617eab7c91b99975dfb1e259609c4fa512e9e08a311a9a2eb65a6cf\r\nTags\r\ntrojan\r\nDetails\r\nName EngineDll.dll\r\nSize 166400 bytes\r\nType PE32 executable (DLL) (GUI) Intel 80386, for MS Windows\r\nMD5 3005f1308e4519477ac25d7bbf054899\r\nSHA1 0cf64de7a635f5760c4684c18a6ad2983a2c0f73\r\nSHA256 2057c0cf4617eab7c91b99975dfb1e259609c4fa512e9e08a311a9a2eb65a6cf\r\nSHA512 77b0b20002ab4a175941a81e309ac6771295abee45497ae507d43fcef237dc7f614bac1e9f97086ef22892db5ef895075c63e467347b08d7e\r\nssdeep 3072:jdouAxXKBsOmN7OslJyOmg/wMFOpYop4vdxZdXYGeJavqL:jd3kCsOM5/YY3d9z\r\nEntropy 6.511161\r\nAntivirus\r\nNo matches found.\r\nYARA Rules\r\nNo matches found.\r\nssdeep Matches\r\nNo matches found.\r\nPE Metadata\r\nCompile Date 2018-02-19 08:23:40-05:00\r\nImport Hash f56b60ba203f4772b5f87e061b59670a\r\nPE Sections\r\nMD5 Name Raw Size Entropy\r\n9ba90552855e9e8b3cfbcec483e4b036 header 1024 2.654189\r\n8244acedace09a0d354fd56aaf0c0f40 .text 123904 6.641205\r\nhttps://us-cert.cisa.gov/ncas/analysis-reports/ar20-133b\r\nPage 4 of 8\n\nMD5 Name Raw Size Entropy\r\n84e6930849c4126353e3367f2431b941 .rdata 25600 5.215729\r\n7403e6dd1ea8fd928cb704a43a82d773 .data 6144 3.443058\r\n9a33838895830247744985365b8b2948 .rsrc 512 5.115767\r\n7c956dfb879b86c9d57c3e783f4ab241 .reloc 9216 5.177068\r\nPackers/Compilers/Cryptors\r\nMicrosoft Visual C++ DLL *sign by CodeRipper\r\nRelationships\r\n2057c0cf46... Downloaded_By 106d915db61436b1a686b86980d4af16227776fc2048f2888995326db0541438\r\n2057c0cf46... Downloaded_By 211.192.239.232\r\nDescription\r\nThis file and 68FA29A40F64C9594CC3DBE8649F9EBC appear identical in functionality, except for the exported function\r\nname. Narrator.exe (24906E88A757CB535EB17E6C190F371F) looks for the exported function name CreateFileEx.\r\n19f9a9f7a0c3e6ca72ea88c655b6500f7da203d46f38076e6e8de0d644a86e35\r\nTags\r\ntrojan\r\nDetails\r\nName EngineDll.dll\r\nSize 166400 bytes\r\nType PE32 executable (DLL) (GUI) Intel 80386, for MS Windows\r\nMD5 68fa29a40f64c9594cc3dbe8649f9ebc\r\nSHA1 b24f6c60fa4ac76ffc11c2fcee961694aeb2141b\r\nSHA256 19f9a9f7a0c3e6ca72ea88c655b6500f7da203d46f38076e6e8de0d644a86e35\r\nSHA512 ffca587964d68e3bea67b4add649b06d768457bf49e2db0708996835f0d9da95cc79bcb6640220053632e993fe545e8ca4cd50309bf0d769c\r\nssdeep 3072:VovrXpvEgEOtXOssvdAeL7Mz81dYFQbEPWgtXJtLNh1jUV46mG:VUDpNyD77YF/+gtHLRj7G\r\nEntropy 6.512934\r\nAntivirus\r\nNo matches found.\r\nYARA Rules\r\nNo matches found.\r\nssdeep Matches\r\nNo matches found.\r\nPE Metadata\r\nCompile Date 2018-02-05 21:20:52-05:00\r\nImport Hash b100cffd23b28dfc257c5feeb1e89eb9\r\nhttps://us-cert.cisa.gov/ncas/analysis-reports/ar20-133b\r\nPage 5 of 8\n\nPE Sections\r\nMD5 Name Raw Size Entropy\r\n35b77733290c275ff61e476e1491ed7a header 1024 2.620308\r\n6a8fcc80d3b556c366b9915ca084df91 .text 123904 6.638987\r\n52890df518ebf2eeba3c08102c595dc1 .rdata 25600 5.207715\r\nf73aec76a9c7a7f6bc0e0dbce1dd57b0 .data 6144 3.442575\r\n9a33838895830247744985365b8b2948 .rsrc 512 5.115767\r\n6f67f8a4390a007724e02090e947d315 .reloc 9216 5.186683\r\nPackers/Compilers/Cryptors\r\nMicrosoft Visual C++ DLL *sign by CodeRipper\r\nRelationships\r\n19f9a9f7a0... Downloaded_By 106d915db61436b1a686b86980d4af16227776fc2048f2888995326db0541438\r\n19f9a9f7a0... Downloaded_By 211.192.239.232\r\nDescription\r\nThis file and 3005F1308E4519477AC25D7BBF054899 appear identical in functionality, except for the exported function\r\nname. Narrator.exe (24906E88A757CB535EB17E6C190F371F) looks for the exported function name CreateFileProcEx.\r\n211.192.239.232\r\nTags\r\ncommand-and-control\r\nPorts\r\n8443 TCP\r\nRelationships\r\n211.192.239.232 Connected_From 106d915db61436b1a686b86980d4af16227776fc2048f2888995326db0541438\r\n211.192.239.232 Downloaded 2057c0cf4617eab7c91b99975dfb1e259609c4fa512e9e08a311a9a2eb65a6cf\r\n211.192.239.232 Downloaded 19f9a9f7a0c3e6ca72ea88c655b6500f7da203d46f38076e6e8de0d644a86e35\r\nDescription\r\nNarrator.exe (24906E88A757CB535EB17E6C190F371F) attempts to download payload from the IP address.\r\nRelationship Summary\r\n106d915db6... Downloaded 2057c0cf4617eab7c91b99975dfb1e259609c4fa512e9e08a311a9a2eb65a6cf\r\n106d915db6... Downloaded 19f9a9f7a0c3e6ca72ea88c655b6500f7da203d46f38076e6e8de0d644a86e35\r\n106d915db6... Connected_To 211.192.239.232\r\n2057c0cf46... Downloaded_By 106d915db61436b1a686b86980d4af16227776fc2048f2888995326db0541438\r\n2057c0cf46... Downloaded_By 211.192.239.232\r\n19f9a9f7a0... Downloaded_By 106d915db61436b1a686b86980d4af16227776fc2048f2888995326db0541438\r\n19f9a9f7a0... Downloaded_By 211.192.239.232\r\nhttps://us-cert.cisa.gov/ncas/analysis-reports/ar20-133b\r\nPage 6 of 8\n\n211.192.239.232 Connected_From 106d915db61436b1a686b86980d4af16227776fc2048f2888995326db0541438\r\n211.192.239.232 Downloaded 2057c0cf4617eab7c91b99975dfb1e259609c4fa512e9e08a311a9a2eb65a6cf\r\n211.192.239.232 Downloaded 19f9a9f7a0c3e6ca72ea88c655b6500f7da203d46f38076e6e8de0d644a86e35\r\nMitigation\r\nThe following Snort rule can be used to detect the FakeTLS LFSR encrypted handshake packets:\r\n// Detects the FakeTLS LFSR encrypted handshake packets\r\n// 17 03 01 00 18 + lfsr_encoded([44-45] 33 22 11 00 00 00 00)\r\nalert tcp any any -\u003e any any (msg:\"Malware Detected\"; pcre:\" /\\x17\\x03\\x01\\x00\\x18.\\x26\\xa5\\xbb\\xf1\\x4f\\x33\\xcb/\";\r\nrev:1; sid:99999999;)\r\nRecommendations\r\nCISA recommends that users and administrators consider using the following best practices to strengthen the security\r\nposture of their organization's systems. Any configuration changes should be reviewed by system owners and administrators\r\nprior to implementation to avoid unwanted impacts.\r\nMaintain up-to-date antivirus signatures and engines.\r\nKeep operating system patches up-to-date.\r\nDisable File and Printer sharing services. If these services are required, use strong passwords or Active Directory\r\nauthentication.\r\nRestrict users' ability (permissions) to install and run unwanted software applications. Do not add users to the local\r\nadministrators group unless required.\r\nEnforce a strong password policy and implement regular password changes.\r\nExercise caution when opening e-mail attachments even if the attachment is expected and the sender appears to be\r\nknown.\r\nEnable a personal firewall on agency workstations, configured to deny unsolicited connection requests.\r\nDisable unnecessary services on agency workstations and servers.\r\nScan for and remove suspicious e-mail attachments; ensure the scanned attachment is its \"true file type\" (i.e., the\r\nextension matches the file header).\r\nMonitor users' web browsing habits; restrict access to sites with unfavorable content.\r\nExercise caution when using removable media (e.g., USB thumb drives, external drives, CDs, etc.).\r\nScan all software downloaded from the Internet prior to executing.\r\nMaintain situational awareness of the latest threats and implement appropriate Access Control Lists (ACLs).\r\nAdditional information on malware incident prevention and handling can be found in National Institute of Standards and\r\nTechnology (NIST) Special Publication 800-83, \"Guide to Malware Incident Prevention \u0026 Handling for Desktops and\r\nLaptops\".\r\nContact Information\r\nDocument FAQ\r\nWhat is a MIFR? A Malware Initial Findings Report (MIFR) is intended to provide organizations with malware analysis in\r\na timely manner. In most instances this report will provide initial indicators for computer and network defense. To request\r\nadditional analysis, please contact CISA and provide information regarding the level of desired analysis.\r\nWhat is a MAR? A Malware Analysis Report (MAR) is intended to provide organizations with more detailed malware\r\nanalysis acquired via manual reverse engineering. To request additional analysis, please contact CISA and provide\r\ninformation regarding the level of desired analysis.\r\nCan I edit this document? This document is not to be edited in any way by recipients. All comments or questions related to\r\nthis document should be directed to the CISA at 1-844-Say-CISA or contact@mail.cisa.dhs.gov .\r\nCan I submit malware to CISA? Malware samples can be submitted via three methods:\r\nWeb: https://malware.us-cert.gov\r\nE-Mail: submit@malware.us-cert.gov\r\nFTP: ftp.malware.us-cert.gov (anonymous)\r\nhttps://us-cert.cisa.gov/ncas/analysis-reports/ar20-133b\r\nPage 7 of 8\n\nCISA encourages you to report any suspicious activity, including cybersecurity incidents, possible malicious code, software\r\nvulnerabilities, and phishing-related scams. Reporting forms can be found on CISA's homepage at www.us-cert.gov.\r\nSource: https://us-cert.cisa.gov/ncas/analysis-reports/ar20-133b\r\nhttps://us-cert.cisa.gov/ncas/analysis-reports/ar20-133b\r\nPage 8 of 8\n\n$h2 = { condition: 45 33 22 11 } \n(uint16(0) == 0x5A4D and uint16(uint32(0x3c)) == 0x4550) and all of them\n} \n Page 2 of 8\n\nPE Sections MD5 Name Raw Size Entropy\n9ba90552855e9e8b3cfbcec483e4b036 header 1024 2.654189\n8244acedace09a0d354fd56aaf0c0f40 .text 123904 6.641205\n Page 4 of 8 \n\n https://us-cert.cisa.gov/ncas/analysis-reports/ar20-133b \nCISA encourages you to report any suspicious activity, including cybersecurity incidents, possible malicious code, software\nvulnerabilities, and phishing-related scams. Reporting forms can be found on CISA's homepage at www.us-cert.gov.\nSource: https://us-cert.cisa.gov/ncas/analysis-reports/ar20-133b \n Page 8 of 8", "extraction_quality": 1, "language": "EN", "sources": [ "MITRE" ], "origins": [ "web" ], "references": [ "https://us-cert.cisa.gov/ncas/analysis-reports/ar20-133b" ], "report_names": [ "ar20-133b" ], "threat_actors": [ { "id": "34eea331-d052-4096-ae03-a22f1d090bd4", "created_at": "2025-08-07T02:03:25.073494Z", "updated_at": "2026-04-10T02:00:03.709243Z", "deleted_at": null, "main_name": "NICKEL ACADEMY", "aliases": [ "ATK3 ", "Black Artemis ", "COVELLITE ", "CTG-2460 ", "Citrine Sleet ", "Diamond Sleet ", "Guardians of Peace", "HIDDEN COBRA ", "High Anonymous", "Labyrinth Chollima ", "Lazarus Group ", "NNPT Group", "New Romanic Cyber Army Team", "Temp.Hermit ", "UNC577 ", "Who Am I?", "Whois Team", "ZINC " ], "source_name": "Secureworks:NICKEL ACADEMY", "tools": [ "Destover", "KorHigh", "Volgmer" ], "source_id": "Secureworks", "reports": null }, { "id": "732597b1-40a8-474c-88cc-eb8a421c29f1", "created_at": "2025-08-07T02:03:25.087732Z", "updated_at": "2026-04-10T02:00:03.776007Z", "deleted_at": null, "main_name": "NICKEL GLADSTONE", "aliases": [ "APT38 ", "ATK 117 ", "Alluring Pisces ", "Black Alicanto ", "Bluenoroff ", "CTG-6459 ", "Citrine Sleet ", "HIDDEN COBRA ", "Lazarus Group", "Sapphire Sleet ", "Selective Pisces ", "Stardust Chollima ", "T-APT-15 ", "TA444 ", "TAG-71 " ], "source_name": "Secureworks:NICKEL GLADSTONE", "tools": [ "AlphaNC", "Bankshot", "CCGC_Proxy", "Ratankba", "RustBucket", "SUGARLOADER", "SwiftLoader", "Wcry" ], "source_id": "Secureworks", "reports": null }, { "id": "a2b92056-9378-4749-926b-7e10c4500dac", "created_at": "2023-01-06T13:46:38.430595Z", "updated_at": "2026-04-10T02:00:02.971571Z", "deleted_at": null, "main_name": "Lazarus Group", "aliases": [ "Operation DarkSeoul", "Bureau 121", "Group 77", "APT38", "NICKEL GLADSTONE", "G0082", "COPERNICIUM", "Moonstone Sleet", "Operation GhostSecret", "APT 38", "Appleworm", "Unit 121", "ATK3", "G0032", "ATK117", "NewRomanic Cyber Army Team", "Nickel Academy", "Sapphire Sleet", "Lazarus group", "Hastati Group", "Subgroup: Bluenoroff", "Operation Troy", "Black Artemis", "Dark Seoul", "Andariel", "Labyrinth Chollima", "Operation AppleJeus", "COVELLITE", "Citrine Sleet", "DEV-0139", "DEV-1222", "Hidden Cobra", "Bluenoroff", "Stardust Chollima", "Whois Hacking Team", "Diamond Sleet", "TA404", "BeagleBoyz", "APT-C-26" ], "source_name": "MISPGALAXY:Lazarus Group", "tools": [], "source_id": "MISPGALAXY", "reports": null }, { "id": "32a223a8-3c79-4146-87c5-8557d38662ae", "created_at": "2022-10-25T15:50:23.703698Z", "updated_at": "2026-04-10T02:00:05.261989Z", "deleted_at": null, "main_name": "Lazarus Group", "aliases": [ "Lazarus Group", "Labyrinth Chollima", "HIDDEN COBRA", "Guardians of Peace", "NICKEL ACADEMY", "Diamond Sleet" ], "source_name": "MITRE:Lazarus Group", "tools": [ "RawDisk", "Proxysvc", "BADCALL", "FALLCHILL", "WannaCry", "MagicRAT", "HOPLIGHT", "TYPEFRAME", "Dtrack", "HotCroissant", "HARDRAIN", "Dacls", "KEYMARBLE", "TAINTEDSCRIBE", "AuditCred", "netsh", "ECCENTRICBANDWAGON", "AppleJeus", "BLINDINGCAN", "ThreatNeedle", "Volgmer", "Cryptoistic", "RATANKBA", "Bankshot" ], "source_id": "MITRE", "reports": null }, { "id": "f32df445-9fb4-4234-99e0-3561f6498e4e", "created_at": "2022-10-25T16:07:23.756373Z", "updated_at": "2026-04-10T02:00:04.739611Z", "deleted_at": null, "main_name": "Lazarus Group", "aliases": [ "APT-C-26", "ATK 3", "Appleworm", "Citrine Sleet", "DEV-0139", "Diamond Sleet", "G0032", "Gleaming Pisces", "Gods Apostles", "Gods Disciples", "Group 77", "Guardians of Peace", "Hastati Group", "Hidden Cobra", "ITG03", "Jade Sleet", "Labyrinth Chollima", "Lazarus Group", "NewRomanic Cyber Army Team", "Operation 99", "Operation AppleJeus", "Operation AppleJeus sequel", "Operation Blockbuster: Breach of Sony Pictures Entertainment", "Operation CryptoCore", "Operation Dream Job", "Operation Dream Magic", "Operation Flame", "Operation GhostSecret", "Operation In(ter)caption", "Operation LolZarus", "Operation Marstech Mayhem", "Operation No Pineapple!", "Operation North Star", "Operation Phantom Circuit", "Operation Sharpshooter", "Operation SyncHole", "Operation Ten Days of Rain / DarkSeoul", "Operation Troy", "SectorA01", "Slow Pisces", "TA404", "TraderTraitor", "UNC2970", "UNC4034", "UNC4736", "UNC4899", "UNC577", "Whois Hacking Team" ], "source_name": "ETDA:Lazarus Group", "tools": [ "3CX Backdoor", "3Rat Client", "3proxy", "AIRDRY", "ARTFULPIE", "ATMDtrack", "AlphaNC", "Alreay", "Andaratm", "AngryRebel", "AppleJeus", "Aryan", "AuditCred", "BADCALL", "BISTROMATH", "BLINDINGCAN", "BTC Changer", "BUFFETLINE", "BanSwift", "Bankshot", "Bitrep", "Bitsran", "BlindToad", "Bookcode", "BootWreck", "BottomLoader", "Brambul", "BravoNC", "Breut", "COLDCAT", "COPPERHEDGE", "CROWDEDFLOUNDER", "Castov", "CheeseTray", "CleanToad", "ClientTraficForwarder", "CollectionRAT", "Concealment Troy", "Contopee", "CookieTime", "Cyruslish", "DAVESHELL", "DBLL Dropper", "DLRAT", "DRATzarus", "DRATzarus RAT", "Dacls", "Dacls RAT", "DarkComet", "DarkKomet", "DeltaCharlie", "DeltaNC", "Dembr", "Destover", "DoublePulsar", "Dozer", "Dtrack", "Duuzer", "DyePack", "ECCENTRICBANDWAGON", "ELECTRICFISH", "Escad", "EternalBlue", "FALLCHILL", "FYNLOS", "FallChill RAT", "Farfli", "Fimlis", "FoggyBrass", "FudModule", "Fynloski", "Gh0st RAT", "Ghost RAT", "Gopuram", "HARDRAIN", "HIDDEN COBRA RAT/Worm", "HLOADER", "HOOKSHOT", "HOPLIGHT", "HOTCROISSANT", "HOTWAX", "HTTP Troy", "Hawup", "Hawup RAT", "Hermes", "HotCroissant", "HotelAlfa", "Hotwax", "HtDnDownLoader", "Http Dr0pper", "ICONICSTEALER", "Joanap", "Jokra", "KANDYKORN", "KEYMARBLE", "Kaos", "KillDisk", "KillMBR", "Koredos", "Krademok", "LIGHTSHIFT", "LIGHTSHOW", "LOLBAS", "LOLBins", "Lazarus", "LightlessCan", "Living off the Land", "MATA", "MBRkiller", "MagicRAT", "Manuscrypt", "Mimail", "Mimikatz", "Moudour", "Mydoom", "Mydoor", "Mytob", "NACHOCHEESE", "NachoCheese", "NestEgg", "NickelLoader", "NineRAT", "Novarg", "NukeSped", "OpBlockBuster", "PCRat", "PEBBLEDASH", "PLANKWALK", "POOLRAT", "PSLogger", "PhanDoor", "Plink", "PondRAT", "PowerBrace", "PowerRatankba", "PowerShell RAT", "PowerSpritz", "PowerTask", "Preft", "ProcDump", "Proxysvc", "PuTTY Link", "QUICKRIDE", "QUICKRIDE.POWER", "Quickcafe", "QuiteRAT", "R-C1", "ROptimizer", "Ratabanka", "RatabankaPOS", "Ratankba", "RatankbaPOS", "RawDisk", "RedShawl", "Rifdoor", "Rising Sun", "Romeo-CoreOne", "RomeoAlfa", "RomeoBravo", "RomeoCharlie", "RomeoCore", "RomeoDelta", "RomeoEcho", "RomeoFoxtrot", "RomeoGolf", "RomeoHotel", "RomeoMike", "RomeoNovember", "RomeoWhiskey", "Romeos", "RustBucket", "SHADYCAT", "SHARPKNOT", "SIGFLIP", "SIMPLESEA", "SLICKSHOES", "SORRYBRUTE", "SUDDENICON", "SUGARLOADER", "SheepRAT", "SierraAlfa", "SierraBravo", "SierraCharlie", "SierraJuliett-MikeOne", "SierraJuliett-MikeTwo", "SimpleTea", "SimplexTea", "SmallTiger", "Stunnel", "TAINTEDSCRIBE", "TAXHAUL", "TFlower", "TOUCHKEY", "TOUCHMOVE", "TOUCHSHIFT", "TOUCHSHOT", "TWOPENCE", "TYPEFRAME", "Tdrop", "Tdrop2", "ThreatNeedle", "Tiger RAT", "TigerRAT", "Trojan Manuscript", "Troy", "TroyRAT", "VEILEDSIGNAL", "VHD", "VHD Ransomware", "VIVACIOUSGIFT", "VSingle", "ValeforBeta", "Volgmer", "Vyveva", "W1_RAT", "Wana Decrypt0r", "WanaCry", "WanaCrypt", "WanaCrypt0r", "WannaCry", "WannaCrypt", "WannaCryptor", "WbBot", "Wcry", "Win32/KillDisk.NBB", "Win32/KillDisk.NBC", "Win32/KillDisk.NBD", "Win32/KillDisk.NBH", "Win32/KillDisk.NBI", "WinorDLL64", "Winsec", "WolfRAT", "Wormhole", "YamaBot", "Yort", "ZetaNile", "concealment_troy", "http_troy", "httpdr0pper", "httpdropper", "klovbot", "sRDI" ], "source_id": "ETDA", "reports": null } ], "ts_created_at": 1775438978, "ts_updated_at": 1775826737, "ts_creation_date": 0, "ts_modification_date": 0, "files": { "pdf": "https://archive.orkl.eu/c83acffac6803f5a3cd8ac669b3ef15827aff676.pdf", "text": "https://archive.orkl.eu/c83acffac6803f5a3cd8ac669b3ef15827aff676.txt", "img": "https://archive.orkl.eu/c83acffac6803f5a3cd8ac669b3ef15827aff676.jpg" } }