Loading malware…
NESTEGG is a Lazarus-linked backdoor associated with the financially motivated North Korean cluster APT38 and also referenced in connection with BlueNoroff activity. It has been used in intrusions targeting financial organizations as part of broader DPRK cyber operations focused on bank theft and related post-compromise activity. A documented capability of NESTEGG is bidirectional file transfer, allowing operators to download additional tools or payloads to a victim system and upload files from the compromised host. This behavior supports follow-on intrusion stages such as tool deployment and remote operator control within victim environments. Public reporting places NESTEGG within the wider Lazarus malware ecosystem used across financially motivated campaigns.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Malware associated with BlueNorOff include: "DarkComet, Mimikatz, Nestegg, Macktruck, WannaCry, Whiteout, Quickcafe, Rawhide, Smoothride, TightVNC, Sorrybrute, Keylime, Snapshot, Mapmaker, net.exe, sysmon, Bootwreck, Cleantoad, Closeshave, Dyepack, Hermes, Twopence, Electricfish, Powerratankba, and Powerspritz"
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Malware family associated with BlueNorOff operations.
Named Lazarus-linked malware/tool referenced in legal and technical reporting.
Backdoor with file upload/download capability.
DPRK-linked malware referenced as being used against financial targets.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.