MalwareUsed by 1 actor

Cryptoistic

Cryptoistic is a Lazarus Group-associated malware family documented as supporting command-and-control over TCP with encrypted communications. Reported functionality includes collecting user information from compromised hosts, retrieving files from local file systems, and deleting files on infected systems, indicating a combination of reconnaissance, collection, exfiltration support, and anti-forensic cleanup behavior. It has been referenced alongside other Lazarus-linked malware families used in North Korean state-sponsored operations targeting sectors such as finance, cryptocurrency, defense, software, pharmaceuticals, manufacturing, and related industries. Based on the available facts, Cryptoistic is best characterized as a backdoor-oriented implant used for post-compromise host interaction and data handling on Windows systems.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

Lazarus

Related Malware: AppleJeus BADCALL Bankshot BLINDINGCAN Cryptoistic Dtrack KEYMARBLE KiloAlfa SierraAlfa ThreatNeedle Torisma WannaCry

via brandefensebrandefense.io

MITRE ATT&CK

Techniques & procedures

8 distinct techniques documented for this family, organized by ATT&CK tactic.

Stealth

1 technique

T1070.004File DeletionEvidence8

The content repeatedly describes malware and threat actors deleting files, directories, droppers, logs, scripts, temporary files, exfiltrated archives, and uninstalling themselves to cover tracks or reduce forensic artifacts.

Discovery

2 techniques

T1033System Owner/User DiscoveryEvidence6

The content repeatedly describes malware and threat actors collecting the victim username, identifying logged-in users, running whoami, query user, quser, or similar commands to determine the current user or user sessions.

T1083File and Directory DiscoveryEvidence5

The content is a long ATT&CK-style listing of groups and malware that can 'list files and directories,' 'search for files,' 'enumerate drives,' 'gather file metadata,' or 'browse file systems' on compromised hosts.

Collection

1 technique

T1005Data from Local SystemEvidence4

Andariel has collected large numbers of files from compromised network systems for later extraction... APT28 has retrieved internal documents from machines inside victim environments... BADNEWS crawls the victim's local drives and collects documents... many listed groups and malware collect files, documents, credentials, payment card data, or other information from compromised hosts.

Command and Control

4 techniques

T1095Non-Application Layer ProtocolEvidence1

T1105Ingress Tool TransferEvidence2

The content repeatedly describes malware and threat actors that can "download files from C2," "download additional payloads," "upload and download files," "retrieve payloads from the C2 server," and "copy files to remote machines."

T1573Encrypted ChannelEvidence3

“APT29 has used multiple layers of encryption within malware to protect C2 communication… BITTER has encrypted their C2 communications… MacMa has used TLS encryption… Magic Hound has used an encrypted http proxy in C2 communications… gh0st RAT has encrypted TCP communications…”

T1573.001Symmetric CryptographyEvidence1

“APT29 has used multiple layers of encryption within malware to protect C2 communication… BITTER has encrypted their C2 communications… Emotet has encrypted data before sending to the C2 server… gh0st RAT has encrypted TCP communications to evade detection… Gomir uses a custom encryption algorithm…”

ACTIVITY FEED

Recent activity

15 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

15 SOURCESView more in app

mitre attack websiteNews

Oct 25, 2022

System Owner/User Discovery, Technique T1033 - Enterprise | MITRE ATT&CK®

Malware that gathers data on the user of a compromised host.

brandefenseNews

Aug 15, 2022

Lazarus APT Group (APT38) - Brandefense

Lazarus-associated malware family listed as related malware.

mitre attack websiteNews

Oct 21, 2021

System Owner/User Discovery, Technique T1033 - Enterprise | MITRE ATT&CK®

Gathers data on the user of a compromised host.

mitre attack websiteNews

Oct 21, 2021

Data from Local System, Technique T1005 - Enterprise | MITRE ATT&CK®

Malware that retrieves files from the local file system.

+11 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping8

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Cryptoistic