Loading malware…
Volgmer is a Windows backdoor associated with the Lazarus Group, also tracked in U.S. government reporting under the HIDDEN COBRA designation. It has been in use since at least 2014 and remained active through roughly 2021, primarily in intrusions targeting Korean organizations as well as broader Lazarus operations. Reported victim sectors include defense, manufacturing, ICT, finance, satellite, software, and media.
Volgmer commonly operates as a service-based implant and has been observed installing itself by copying its DLL into a service context and modifying service-related registry configuration so the malware loads as a ServiceDLL. A characteristic trait is storage of encoded or encrypted configuration data in the Windows Registry under the WMI Security area, which the malware reads at runtime. Variants have used RC4 for configuration decryption, while traffic and files have also been protected with simple XOR; some variants reportedly used SSL for command-and-control encryption.
The malware provides full remote backdoor functionality. Documented capabilities include collecting host and network information such as the victim IP address, enumerating running processes, checking registry keys, executing payloads and commands through native Windows APIs including CreateProcessW, uploading and downloading files, deleting files, and launching reverse-shell style functionality. Volgmer also supports command-and-control configuration changes and sleep adjustments. It uses HTTP-based communications, including variants communicating to HTTPS endpoints, and has shown evolving protocol details over time.
Volgmer incorporates multiple defense-evasion and anti-analysis measures. Reported behaviors include runtime deobfuscation of strings and API names, timestomping in some deployment chains, and self-deletion or deletion of dropped artifacts after infection to hinder analysis and cleanup traces. Its long operational history, registry-resident configuration, service-based persistence, and association with Lazarus make it a notable DPRK-linked backdoor family.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
3 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Alert (TA17-318B): HIDDEN COBRA – North Korean Trojan: Volgmer
In this post, we will analyze Volgmer and Scout, the two major malware strains used in their attacks. Volgmer is a backdoor that has been used by the Lazarus threat group since 2014.
34 distinct techniques documented for this family, organized by ATT&CK tactic.
For the last few years, the group launched watering hole attacks to attack multiple Korean enterprises and organizations in the fields of defense, satellite, software, and media.
Their method for initial access involved the exploitation of a security vulnerability of a Korean financial security certification software.
The content repeatedly describes threat actors and malware using cmd.exe, the Windows command shell, to execute commands, launch payloads, run batch files, and automate actions on compromised hosts.
The content is a MITRE ATT&CK-style listing of many malware families and threat groups using Windows/native OS APIs for execution, injection, discovery, anti-debugging, and other actions, ending with 'NtCreateProcess' and 'fork()'.
Volgmer, which usually runs by being registered as a service, is installed with a name that disguises it as a legitimate file.
The content repeatedly describes malware and threat actors deleting files, directories, droppers, logs, scripts, temporary files, exfiltrated archives, and uninstalling themselves to cover tracks or reduce forensic artifacts.
After creating the Volgmer DLL in the path %SystemDirectory%, the dropper sets the time configuration information to be the same as the Notepad (notepad.exe) file. This timestomping is one of the major anti-forensic techniques employed for the purpose of evading timeline analysis.
The content is a long ATT&CK-style listing of malware and threat groups that 'decrypt', 'decode', 'deobfuscate', 'unpack', or 'decompress' payloads, strings, configuration data, shellcode, and files prior to execution or use.
The dropper also checks the number of arguments, recognizes Korean operating environments, and even checks the version of Windows operating environments, and if these do not match pre-configured conditions, it either displays a message box or deletes itself.
running services are scanned through the port that is currently being listened to; targets include FTP, SSH, DNS, HTTP, SMB, RDP, MS-SQL, and VNC.
The content repeatedly describes malware and threat actors querying, enumerating, opening, and reading Windows Registry keys and values, e.g., "APT41 queried registry values to determine items such as configured RDP ports and network configurations" and "Reg may be used to gather details from the Windows Registry of a local or remote system at the command-line interface."
AdFind can extract subnet information from Active Directory; actors used ipconfig /all, netsh.exe, ifconfig, arp, route, nbtstat, and related APIs/commands to gather IP, MAC, DNS, DHCP, gateway, proxy, routing, ARP, and adapter information.
Tasklist can be used to discover processes running on a system. Numerous malware families and threat groups are described as listing running processes, collecting PIDs, checking for specific process names, or enumerating loaded modules.
The content repeatedly describes malware and threat actors collecting OS version, computer name, architecture, CPU, memory, disk, BIOS, language, and other host details; examples include use of commands such as ver, systeminfo, hostname, uname -m, and WMI to gather host information.
The content is a long ATT&CK-style listing of groups and malware that can 'list files and directories,' 'search for files,' 'enumerate drives,' 'gather file metadata,' or 'browse file systems' on compromised hosts.
Numerous entries mention enumerating drives, logical disks, disk type, free space, or volume information; examples include 'Babuk can enumerate disk volumes,' 'Cuba can enumerate local drives,' and 'TAINTEDSCRIBE can use DriveList to retrieve drive information.'
The dropper also checks the number of arguments, recognizes Korean operating environments, and even checks the version of Windows operating environments, and if these do not match pre-configured conditions, it either displays a message box or deletes itself.
Many entries describe XOR, XOR/ADD, bitwise NOT and XOR, ROR plus XOR, hexadecimal encoding after encryption, and custom encoding/obfuscation of HTTP traffic or beacons.
Volgmer selects one of the C&C server addresses from the configuration data and connects to it... It then transmits an HTTP packet... The later version of Volgmer and the Scout downloader to be covered later use the HTTP protocol to communicate with the C&C server.
16 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
45 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A named malware family/tool referenced in TraderTraitor-related reporting.
A Lazarus-linked backdoor used from about 2014 to 2021 for persistent control of infected systems. It commonly runs as a service, stores encrypted configuration data in the registry under HKLM\SYSTEM\CurrentControlSet\Control\WMI\Security, communicates over HTTP/HTTPS with C2, profiles the host, and supports commands such as file transfer, command execution, reverse shell, timestomping, and anti-forensic deletion.
A Lazarus/Hidden Cobra-associated backdoor referenced for code/key overlap. The article says the sample shared Volgmer’s 16-byte key but differed in how the key was used, so it was not classified as Volgmer proper.
Gathers IP addresses from victim machines.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.