Torisma

TorisMa is a Lazarus Group malware family associated with Operation Dream Job, a highly targeted campaign that used recruiter-themed social engineering to compromise organizations in research, defense, and financial or payments sectors. It is a Windows implant delivered selectively as a second-stage payload only after an earlier-stage infection profiled the victim and backend infrastructure determined the host was of interest, including allow-list based gating by victim network characteristics. This selective deployment model indicates a tailored post-compromise tool used for higher-value targets rather than broad indiscriminate distribution.

The malware supports host reconnaissance and data theft. Reported capabilities include collecting local network configuration details such as IP and MAC address information, obtaining the current system time, and transmitting victim data to actor-controlled command-and-control infrastructure. Its command-and-control traffic is obfuscated through Base64 encoding and additionally protected with XOR and VEST-32 encryption. Samples have also been observed packed with Iz4 compression, consistent with Lazarus tradecraft aimed at hindering analysis and detection. TorisMa uses Windows API functionality during execution.

In the broader Lazarus intrusion chain, TorisMa appears as part of a custom malware ecosystem that includes tools such as Sumarta, DBLL Dropper, and DRATzarus. Delivery in documented Dream Job activity began with spearphishing emails carrying malicious Microsoft Word documents and macros that installed a first-stage reconnaissance implant; only selected victims subsequently received TorisMa. This places TorisMa in a post-exploitation role focused on intelligence collection and exfiltration within carefully curated victim environments.