Lazarus Group

Adversaries may manipulate accounts to maintain and/or elevate access to victim systems. Account manipulation may consist of any action that preserves

Adversaries may attempt to get a listing of open application windows. Window listings could convey information about how the system is used.(Citation:

An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data a

An adversary may compress or encrypt data that is collected prior to exfiltration using a custom method. Adversaries may choose to use custom archival

An adversary may compress or encrypt data that is collected prior to exfiltration using 3rd party libraries. Many libraries exist that can archive dat

Adversaries may use an existing, legitimate external Web service as a means for sending commands to and receiving output from a compromised system ove

Adversaries may use bootkits to persist on systems. A bootkit is a malware variant that modifies the boot sectors of a hard drive, allowing malicious

In addition to clearing system logs, an adversary may clear the command history of a compromised account to conceal the actions undertaken during an i

Adversaries may create, acquire, or steal code signing materials to sign their malware or tools. Code signing provides a level of authenticity on a bi

Adversaries may create a new process with an existing token to escalate privileges and bypass access controls. Processes can be created with the token

Adversaries may abuse dynamic-link library files (DLLs) in order to achieve persistence, escalate privileges, and evade defenses. DLLs are libraries t

Adversaries may destroy data and files on specific systems or in large numbers on a network to interrupt availability to systems, services, and networ

Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to

Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They

Adversaries may buy and/or steal SSL/TLS certificates that can be used during targeting. SSL/TLS certificates are designed to instill trust. They incl

Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detectio

Adversaries may erase the contents of storage devices on specific systems or in large numbers in a network to interrupt availability to system and net

Adversaries may corrupt or wipe the disk data structures on a hard drive necessary to boot a system; targeting specific critical systems or in large n

Adversaries may acquire domains that can be used during targeting. Domain names are the human readable names used to represent one or more IP addresse

Adversaries may gain access to a system through a user visiting a website over the normal course of browsing. Multiple ways of delivering exploit code

Adversaries may obfuscate then dynamically resolve API functions called by their malware in order to conceal malicious functionalities and impair defe

Adversaries may inject dynamic-link libraries (DLLs) into processes in order to evade process-based defenses as well as possibly elevate privileges. D

Adversaries may create email accounts that can be used during targeting. Adversaries can use accounts created with email providers to further their op

Adversaries may gather email addresses that can be used during targeting. Even if internal instances exist, organizations may have public-facing email

Adversaries may embed payloads within other files to conceal malicious content from defenses. Otherwise seemingly benign files (such as scripts and ex

Adversaries may encrypt or encode files to obfuscate strings, bytes, and other specific patterns to impede detection. Encrypting and/or encoding file

Adversaries may steal data by exfiltrating it over an existing command and control channel. Stolen data is encoded into the normal communications chan

Adversaries may steal data by exfiltrating it over an un-encrypted network protocol other than that of the existing command and control channel. The d

Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding

Adversaries may use an external proxy to act as an intermediary for network communications to a command and control server to avoid direct connections

AppleJeus is a family of downloaders initially discovered in 2018 embedded within trojanized cryptocurrency

AuditCred is a malicious DLL that has been used by Lazarus Group d

BADCALL is a Trojan malware variant used by the group [Lazarus Group](https://attack.mitre.org/groups/G0032

BLINDINGCAN is a remote access Trojan that has been used by the North Korean government since at least earl

Bankshot is a remote access tool (RAT) that was first reported by the Department of Homeland Security in De

Cryptoistic is a backdoor, written in Swift, that has been used by [Lazarus Group](https://attack.mitre.org

Dacls is a multi-platform remote access tool used by Lazarus Group

Dtrack is spyware that was discovered in 2019 and has been used against Indian financial institutions, rese

ECCENTRICBANDWAGON is a remote access Trojan (RAT) used by North Korean cyber actors that was first identif

FALLCHILL is a RAT that has been used by Lazarus Group since at le

HARDRAIN is a Trojan malware variant reportedly used by the North Korean government. (Citation: US-CERT HAR

HOPLIGHT is a backdoor Trojan that has reportedly been used by the North Korean government.(Citation: US-CE

HotCroissant is a remote access trojan (RAT) attributed by U.S. government entities to malicious North Kore

KEYMARBLE is a Trojan that has reportedly been used by the North Korean government. (Citation: US-CERT KEYM

MagicRAT is a remote access tool developed in C++ and exclusively used by the [Lazarus Group](https://attac

Proxysvc is a malicious DLL used by Lazarus Group in a campaign kn

RATANKBA is a remote controller tool used by Lazarus Group. [RATAN

RawDisk is a legitimate commercial driver from the EldoS Corporation that is used for interacting with file

Responder is an open source tool used for LLMNR, NBT-NS and MDNS poisoning, with built-in HTTP/SMB/MSSQL/FTP/LDAP rogue authentication server supporti

TAINTEDSCRIBE is a fully-featured beaconing implant integrated with command modules used by [Lazarus Group]

TYPEFRAME is a remote access tool that has been used by [Lazarus Group](https://attack.mitre.org/groups/G00

ThreatNeedle is a backdoor that has been used by Lazarus Group sin

Volgmer is a backdoor Trojan designed to provide covert access to a compromised system. It has been used si

WannaCry is ransomware that was first seen in a global attack during May 2017, which affected more than 150

netsh is a scripting utility used to interact with networking components on local or remote systems. (Citat

route can be used to find or change information within the local system IP routing table. (Citation: TechNe

On 29 October 2026, starting at 20:05 UTC, about USD 6.3 billion in cryptocurrency was moved out of Binance wallets, most of it within about 20 minute

Operation Dream Job was a cyber espionage operation likely conducted by [Lazarus Group](https://attack.mit