Loading malware…
VSingle is a Lazarus-associated multi-platform backdoor used in North Korean espionage operations. It has been observed in intrusions against organizations including energy-sector targets, often after exploitation of internet-facing enterprise software such as VMware Horizon. Security reporting has documented both Windows and Linux variants, with the malware used to establish long-term access, receive remote tasking over HTTP, and support follow-on operations including data theft and deployment of additional payloads.
On Windows, VSingle has been described as a multi-layer implant that injects shellcode into a spawned benign process and reflectively loads a DLL payload. It supports arbitrary command execution, reverse shell access, file transfer, downloading and executing plugins, updating itself, reporting host information, and uninstalling itself. Reported plugin support includes executable content and in-memory shellcode execution. VSingle has also been observed persisting through multiple mechanisms including services, scheduled tasks, Startup-folder entries, and Run-key autostart.
On Linux, newer VSingle variants include fallback logic to retrieve updated command-and-control information from attacker-controlled GitHub repositories when hard-coded servers are unavailable. These variants use command-line web retrieval utilities for network communications, store responses in temporary files, and exfiltrate command output via HTTP POST after Base64 encoding. Across variants, VSingle uses encrypted or obfuscated communications and has been reported to obtain encrypted tasking from HTTP responses.
VSingle is closely associated with Lazarus Group activity and has been reported alongside other Lazarus malware families including YamaBot and MagicRAT. It has been used as a durable post-compromise implant in hands-on-keyboard intrusions involving reconnaissance, credential access, lateral movement, and exfiltration. Targeting has included Windows and Linux systems in enterprise environments, with reporting highlighting campaigns affecting organizations in the United States, Canada, Japan, and other regions.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
The initial vector was the exploitation of the Log4j vulnerability on exposed VMware Horizon servers... Cisco Talos identified the exploitation of the Log4Shell vulnerability on VmWare Horizon public-facing servers as the initial attack vector. | Talos has discovered the use of two known families of malware in these intrusions — VSingle and YamaBot. ... followed by the deployment of the group's custom malware implants, VSingle and YamaBot.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Talos has discovered the use of two known families of malware in these intrusions — VSingle and YamaBot. ... followed by the deployment of the group's custom malware implants, VSingle and YamaBot.
31 distinct techniques documented for this family, organized by ATT&CK tactic.
schTasks /Create /F /TN "%s" /TR "%s" /SC onlogon Scheduled task triggered at logon [T1053/005]
schTasks /Create /F /TN "%s" /TR "%s" /SC onlogon Scheduled task triggered at logon [T1053/005]
schTasks /Create /F /TN "%s" /TR "%s" /SC onlogon Scheduled task triggered at logon [T1053/005]
The implant spawns a new 'explorer.exe' process and injects shellcode (layer 3) into it for execution.
Once launched, this malware runs Explorer and executes its main code through DLL injection. (Some samples do not perform DLL injection.)
The implant spawns a new 'explorer.exe' process and injects shellcode (layer 3) into it for execution.
Once launched, this malware runs Explorer and executes its main code through DLL injection. (Some samples do not perform DLL injection.)
powershell.exe Get-NetUser 1> \\127.0.0.1\ADMIN$\<impacket_log_file> 2>&1 User Discovery [T1033]
systeminfo & ipconfig /all & netstat -naop tcp & tasklist & net user & net view & arp -a System Information Discovery [T1082]
Recently, the malware used by Lazarus VSingle has been updated to retrieve C2 servers information from GitHub.
As for the command execution results, the contents of the file (/tmp/.sess_%04x) in which the execution results are saved are Base64-encoded and sent via HTTP POST communication as shown below.
These two tools working together create a proxy on the victim system which has its listening port 'exported' to a port on a remote host.
The GitHub repository used by the attacker includes a URL in the <videolink1> tag, as shown in Figure 2. The malware obtains this URL from the GitHub repository and connects to it.
The data after <contents> in this data is the AES key, IV data and command (with Base64+RC4).
the contents of the file (/tmp/.sess_%04x) in which the execution results are saved are Base64-encoded and sent via HTTP POST communication
Some types of malware use DGA, obfuscate destination information, or contain fake C2 server information in order to hide the original C2 server. Others obtain C2 server information from legitimate servers. Recently, the malware used by Lazarus VSingle has been updated to retrieve C2 servers information from GitHub.
96 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Named Lazarus-associated malware family used alongside MagicRAT in the referenced campaign; specific functionality not detailed in the provided content.
Custom Lazarus-developed multi-stage backdoor/RAT used post-exploitation for long-term access. Implements layered loader + injected shellcode leading to a reflectively loaded DLL implant; supports reverse shell, command execution via cmd.exe, downloading/executing additional plugins (shellcode/scripts/executables), and multiple persistence mechanisms (Startup folder, service creation, Run key, scheduled tasks). Used for recon, exfiltration, and manual backdooring (e.g., creating admin users, enabling RDP-related settings).
A Lazarus-developed multi-layer MFC-based backdoor/RAT used to establish long-term access. It injects shellcode through multiple stages, opens a reverse shell, downloads and executes additional plugins or payloads, supports persistence via services/Run keys/scheduled tasks/startup folders, and is used for reconnaissance, exfiltration, and lateral movement support.
Custom Lazarus-attributed implant observed being deployed after MagicRAT removal in some infections.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.