Threat Group Cards: A Threat Actor Encyclopedia
Archived: 2026-04-05 13:48:43 UTC
Home > List all groups > List all tools > List all groups using tool Recon
 Tool: Recon
Names Recon
Category Malware
Type Reconnaissance
Description
(Yoroi) Like other samples, it is written C# programming language too. It has two main classes
named “PortScanner” and “ReconCommonFuncs”, providing a direct clue of the actions
enabled by this part of the implant.
Information Last change to this tool card: 20 April 2020
Download this tool card in JSON format
All groups using tool Recon
Changed Name Country Observed
APT groups
 Iridium 2018-Dec 2018
 Lazarus Group, Hidden Cobra, Labyrinth Chollima 2007-May 2025
2 groups listed (2 APT, 0 other, 0 unknown)
Source: https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=5d6a5bd4-4e84-49a6-a1a5-4c0fd95eb947
https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=5d6a5bd4-4e84-49a6-a1a5-4c0fd95eb947
Page 1 of 1