Loading threat actor…
Pompilus is a North Korea-linked threat actor described in the content as a Lazarus subgroup/cluster, also known as Diamond Sleet. The content specifically notes that the Comebacker backdoor/loader has previously been reported as associated with Pompilus (Diamond Sleet). In the referenced reporting on Lazarus-linked Medusa ransomware activity, attribution to a specific Lazarus subgroup is stated to be unclear in part because some tooling (including Comebacker) has also been associated with other North Korean clusters such as Pompilus/Diamond Sleet.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
6 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
2 malware families attributed to this actor across reporting.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
North Korea-linked activity cluster associated (in prior reporting) with the Comebacker backdoor; mentioned here to note tooling overlap complicating sub-group attribution within Lazarus-linked operations.
North Korea-linked activity cluster associated (in prior reporting) with the Comebacker backdoor; mentioned here to note tool overlap within Lazarus-attributed operations.
Named Lazarus-linked activity cluster referenced as previously associated with the Comebacker backdoor.
North Korea-aligned cluster associated (in prior reporting) with the Comebacker backdoor/loader; mentioned here to highlight tooling overlap complicating attribution among Lazarus sub-groups.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.