Loading malware…
ELECTRICFISH is a Lazarus Group and Hidden Cobra-associated malware tool publicly identified by the U.S. government as part of North Korean malicious cyber activity. It is characterized as a proxy and tunneling utility used to burrow into compromised systems and facilitate the theft of data by relaying network traffic between infected hosts and operator-controlled infrastructure. Reporting places it within the broader Lazarus malware ecosystem alongside other DPRK-linked implants and operational tooling used for espionage and financially motivated intrusions. ELECTRICFISH has been referenced in campaigns and disclosures spanning at least 2019 and is associated with North Korean operations targeting sectors such as finance, critical infrastructure, telecommunications, healthcare, entertainment, and other strategic organizations. Its primary role is post-compromise network tunneling and covert communications support rather than initial infection, enabling operators to move data through victim environments while obscuring command-and-control pathways.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
3 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
The AES algorithm was found in many Lazarus samples: Electricfish, backdoors involved in India attacks, Joanap, various Bluenoroff samples...
Last week, under its North Korean malicious cyberactivity rubric “Hidden Cobra,” the administration issued a public alert about a new version of malware dubbed “ELECTRICFISH” that burrows into victims’ computers to steal data.
Last week, under its North Korean malicious cyberactivity rubric “Hidden Cobra,” the administration issued a public alert about a new version of malware dubbed “ELECTRICFISH” that burrows into victims’ computers to steal data.
3 distinct techniques documented for this family, organized by ATT&CK tactic.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A Lazarus-linked malware variant publicly alerted on by the US in September 2019.
Proxy/tunneling tool set.
North Korean malware publicly alerted by the U.S. government; described as burrowing into victims’ computers to steal data.
A tunneling tool used to route/relay network traffic (as indicated by the IPS signature name).
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.