Hansom

Hansom is ransomware associated with intrusion activity attributed to the Larva-26005 cluster, a threat actor assessed by ASEC as likely linked to North Korea and showing tradecraft similarities to Lazarus and Andariel operations. Hansom has been observed in campaigns connected to earlier CRAT activity and later Xctdoor intrusions, indicating its use within a broader multi-malware ecosystem rather than as a standalone criminal commodity.

Historical reporting tied related operations to spear-phishing campaigns targeting South Korean users, including malicious document and shortcut-based lures, as well as trojanized software masquerading as legitimate applications. In linked intrusion chains, operators also abused compromised web servers, web shells, and vulnerable enterprise applications to gain access and deploy follow-on tooling. Cisco Talos reporting referenced in the available facts indicates Hansom was used to encrypt infected systems in at least some of these operations.

The malware’s primary role is file encryption for impact, and its operational context suggests deployment after initial compromise by other malware families such as CRAT or Xctdoor. The campaigns associated with Hansom have targeted Windows environments and have shown a particular focus on South Korean users and organizations. Available information in this dataset does not support more granular technical characterization of Hansom’s internal mechanisms beyond its ransomware function and its association with Larva-26005-linked attack chains.