Loading malware…
Troy is a newly documented Lazarus Group backdoor used in Operation Dream Job espionage activity. It is delivered as a Windows DLL implant and is loaded directly into memory through a trojanized PDF-viewing workflow. In observed intrusions, victims were lured with fraudulent recruiter outreach and fake job opportunities, then induced to open specially prepared PDF documents or install a trojanized PDF viewer branded as SecurityPDF. When the crafted document was opened, the viewer decrypted an embedded payload and reflectively loaded the Troy implant in memory, reducing on-disk artifacts.
Troy provides remote access and supports 17 operator commands. Reported capabilities include interactive shell access, remote command execution, process termination, in-memory DLL injection, configuration updates, and file operations such as enumeration, upload, download, archiving, and exfiltration. The implant has been described as modular and suited to post-compromise espionage operations.
The malware has been associated with Lazarus campaigns targeting defense, aerospace, and aviation organizations, including victims in Europe, India, and South America. Troy appeared alongside other Lazarus tooling used in the same broader campaign, including MISTPEN, ForestTiger, and FudModule, though Troy itself is specifically the backdoor component delivered via the trojanized PDF viewer chain. Its use reflects Lazarus’s continued emphasis on recruiter-themed social engineering, in-memory execution, and stealthy remote access against high-value enterprise targets on Windows.
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each card links to the full Mallory page for that vulnerability.
1 distinct threat actor Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
...the app decodes an embedded payload that loads a backdoor called Troy straight into memory.
27 distinct techniques documented for this family, organized by ATT&CK tactic.
Victims are instructed to download SecurityPDF, a trojanized PDF viewer, from one of several websites impersonating Enveil... Once installed, the modified viewer inspects any PDF opened through it for a hidden marker.
The group built at least three websites impersonating privacy technology vendor Enveil, some ranking top in search results... Those sites distributed a trojanized PDF viewer that runs a payload hidden inside crafted documents, delivering Troy, a previously undocumented backdoor supporting 17 operator commands.
The attackers pose as recruiters offering enticing job opportunities, a social engineering trick Lazarus has relied on for years to lure employees at high-value targets into opening malicious files.
targets are trapped via fake recruiter messages and lured into opening an infected PDF
Les attaquants usurpent l’identité de recruteurs sur LinkedIn et via des applications de messagerie directe, proposant de fausses offres d’emploi auprès d’entreprises reconnues.
Attacks begin with fraudulent job offers, supposedly from well-known companies, sent through direct messages or platforms like LinkedIn and mainly targeting the defense and aerospace sectors in Europe and India.
Troy est un implant DLL unique... supportant 17 commandes opérateur : Accès shell interactif
Troy supports 17 different commands including interactive shell access, process termination, in-memory DLL injection and the ability to enumerate, upload, download, and archive and exfiltrate files.
распространяли модифицированный PDF-ридер SecurityPDF, который предназначался для выполнения малвари, встроенной в заранее подготовленные хакерами PDF-файлы.
In the first, the victim is convinced to download an encrypted ZIP archive containing three files... When the victim launches the executable, the malicious DLL libmupdf.dll is loaded via DLL sideloading.
распространяли модифицированный PDF-ридер SecurityPDF, который предназначался для выполнения малвари, встроенной в заранее подготовленные хакерами PDF-файлы. После открытия такие вредоносные PDF запускали новый бэкдор группировки под названием Troy.
These attacks involve Lazarus distributing a modified PDF viewer called SecurityPDF designed to execute malicious payloads embedded within attacker-crafted PDF files when the user opens them.
Troy supports 17 different commands including interactive shell access, process termination, in-memory DLL injection and the ability to enumerate, upload, download, and archive and exfiltrate files.
Для эксплуатации этой уязвимости, приводящей к повышению привилегий, атакующему нужно было иметь доступ к системе, а также возможность выполнения кода... хакер мог повысить привилегии до уровня SYSTEM без участия пользователя.
archive chiffrée contenant un viewer PDF légitime signé numériquement, une DLL malveillante et un payload chiffré... le payload est déchiffré
Les attaquants usurpent l’identité de recruteurs... proposant de fausses offres d’emploi auprès d’entreprises reconnues... viewer PDF légitime signé numériquement... sites usurpant l’identité d’Enveil.
Troy supports 17 different commands including interactive shell access, process termination, in-memory DLL injection and the ability to enumerate, upload, download, and archive and exfiltrate files.
These attacks involve Lazarus distributing a modified PDF viewer called SecurityPDF designed to execute malicious payloads embedded within attacker-crafted PDF files when the user opens them.
decodes an embedded payload that loads a backdoor called Troy straight into memory
Check Point's analysis revealed that the hackers have also deployed a new backdoor called Troy that supports 17 commands, including the following: System and process reconnaissance
Check Point's analysis revealed that the hackers have also deployed a new backdoor called Troy that supports 17 commands, including the following: System and process reconnaissance
Troy supports 17 different commands including interactive shell access, process termination, in-memory DLL injection and the ability to enumerate, upload, download, and archive and exfiltrate files.
DOWNLOAD|<victim-source>|<client-destination> File exfiltration Streams a file from the victim to the operator in chunks.
Troy supports 17 different commands including interactive shell access, process termination, in-memory DLL injection and the ability to enumerate, upload, download, and archive and exfiltrate files.
At startup, the implant iterates through the configured servers in order ... establishing an HTTP connection
Rather than standing up dedicated servers, Lazarus routed command-and-control traffic through hijacked Roundcube webmail and WordPress or PrestaShop sites.
Rather than standing up dedicated servers, Lazarus routed command-and-control traffic through hijacked Roundcube webmail and WordPress or PrestaShop sites.
rosszindulatú PDF dokumentumokat terjesztve, amelyek letöltő (MISTPEN) és backdoor (ForestTiger, Troy) komponenseket töltenek le Microsoft Graph / OneDrive infrastruktúra felhasználásával
Troy supports 17 different commands including interactive shell access, process termination, in-memory DLL injection and the ability to enumerate, upload, download, and archive and exfiltrate files.
20 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
17 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.