Nestdoor

Nestdoor is a Windows remote access trojan associated with the North Korean state-linked Andariel intrusion set, which is part of the broader Lazarus ecosystem. It has been observed since at least 2022 in campaigns targeting South Korean organizations, including manufacturing, construction, and educational entities, and has also been linked to exploitation activity involving vulnerable public-facing servers such as VMware Horizon systems affected by Log4Shell. Nestdoor has repeatedly appeared alongside other Andariel tooling, including TigerRAT, proxy utilities, web shells, stealers, and separate keylogging components.

Nestdoor provides remote control of infected systems by receiving operator commands from command-and-control infrastructure. Reported capabilities include file operations and reverse shell access, enabling operators to execute commands and manage victim-host data after compromise. Variants observed in later campaigns retained core remote-control and obfuscation behavior while exposing a reduced command set compared with earlier samples. Nestdoor has also been observed establishing persistence through Windows Scheduled Tasks.

Distribution has included both post-exploitation deployment after server compromise and delivery disguised as legitimate software. In one observed campaign, operators compromised an outdated Apache Tomcat server and used it to distribute malware. In another, Nestdoor was masqueraded as OpenVPN software, reflecting Andariel’s broader use of deceptive packaging and signed malware in some operations. Operationally, Nestdoor is part of a wider espionage toolkit used to maintain access, support hands-on-keyboard activity, and facilitate data theft from targeted environments.