Loading story…
CISA published malware analysis reports covering multiple state-linked implants, including the North Korean COPPERHEDGE and BLINDINGCAN remote access tools and the SUNBURST backdoor tied to the SolarWinds compromise. The reports describe how these malware families were used to establish persistence, conduct reconnaissance, execute arbitrary commands, and exfiltrate data from victim environments, with COPPERHEDGE specifically attributed with high confidence to North Korean HIDDEN COBRA actors and linked to campaigns targeting cryptocurrency exchanges and related entities.
The technical reporting highlights distinct malware variants, command-and-control patterns, and detection opportunities for defenders. For COPPERHEDGE, CISA documented six variants across Windows DLL samples, noting differences in HTTP beaconing, encryption, and POST formatting, including use of RC4, Base64, XOR-based encoding, and Google Analytics-like cookies, alongside dozens of associated domains and sample hashes. Across the reports, CISA provided indicators, malware characteristics, and detection guidance such as YARA and Snort signatures to help organizations identify related activity and prioritize mitigation and reporting.
Pull IOCs and campaign context straight into your stack.
3 events from the most recent confirmed update back to the earliest known activity.
CISA released analysis report MAR-10318845-1.v1 on SUNBURST. The reference indicates the report was published in April 2021.
CISA released analysis report MAR-10295134-1.v1 covering BLINDINGCAN, a North Korean remote access trojan. The reference indicates the report was published in August 2020.
CISA published Malware Analysis Report MAR-10288834-1.v1 on COPPERHEDGE, a remote access tool attributed with high confidence to North Korean HIDDEN COBRA actors. The report detailed multiple variants, command-and-control behavior, and detection guidance including domains, hashes, YARA, and Snort signatures.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 278 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
3 references tracked. Mallory keeps watching after this page renders.
us-cert.cisa.gov
Open sourceweb.archive.org
Open sourcecisa.gov
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Cisco and Palo Alto researchers detailed multiple intrusion campaigns that relied on evasive malware to establish persistence and hide command-and-control traffic, including **ObliqueRAT**, **GoldMax**, **NimzaLoader**, and the **SUNBURST** backdoor tied to the SolarWinds Orion supply-chain compromise. In the SolarWinds intrusion, attackers distributed a trojanized, digitally signed Orion update that deployed **SUNBURST**, which masked its communications as legitimate Orion Improvement Program traffic and was later used to deliver follow-on payloads such as **TEARDROP** and customized **Cobalt Strike BEACON** implants. Cisco Talos also reported that **Transparent Tribe** revived **ObliqueRAT** in campaigns aimed largely at organizations in South Asia, using malicious Office documents to retrieve payloads concealed in BMP image files hosted on hijacked websites. Researchers said newer ObliqueRAT variants added anti-analysis features, screenshot and webcam capture, removable-drive file theft, and updated persistence methods, while Cisco’s broader threat review noted that **GoldMax** used encrypted per-implant configuration and decoy traffic, and **NimzaLoader** used phishing emails, fake PDF-preview links, JSON-based communications, and process injection to deliver second-stage access.
Aug 15, 2026
Reporting across multiple research teams described a surge of distinct, ongoing intrusion campaigns rather than a single unified incident. **Check Point** reported on **Silver Dragon**, a Chinese-aligned activity cluster assessed as operating under the broader **APT41** umbrella, targeting organizations in **Southeast Asia and Europe** (notably government) via exploitation of public-facing servers and phishing, then deploying **Cobalt Strike**, **DNS tunneling**, and a new Google Drive–based backdoor (**GearDoor**) alongside custom tools (**SSHcmd** and **SliverScreen**) for remote access and screen capture. **Microsoft** detailed separate February 2026 phishing campaigns by an unknown actor that used meeting/invoice-style lures and **EV code-signed** malware (certificate issued to **TrustConnect Software PTY LTD**) masquerading as common workplace apps (e.g., `msteams.exe`, `adobereader.exe`, `zoomworkspace.clientsetup.exe`) to install legitimate **RMM** tooling (**ScreenConnect**, **Tactical RMM**, **Mesh Agent**) for persistent access and lateral movement. Other reporting highlighted additional, unrelated campaigns and tradecraft: **ClearSky** described a Russian-aligned operation targeting **Ukraine** using a phishing-delivered ZIP/HTA chain that drops a .NET loader (**BadPaw**) and backdoor (**MeowMeow**) with **.NET Reactor** obfuscation, parameter-gated execution, and sandbox/tooling checks (with low-confidence linkage to **APT28**). **Cofense**-reported activity (via SC Media) showed phishing that weaponizes **Windows File Explorer + WebDAV** using URL/LNK shortcuts to pull payloads (notably **AsyncRAT**, **XWorm**, **DcRAT**) and infrastructure including **Cloudflare Tunnel** domains hosting WebDAV servers. **Cisco Talos**-reported **Dohdoor** activity (UAT-10027) targeted US **education and healthcare**, using PowerShell→batch→DLL sideloading via legitimate executables (e.g., `Fondue.exe`, `mblctr.exe`, `ScreenClippingHost.exe`) and **DNS-over-HTTPS** to Cloudflare for C2 discovery and tunneling. Separately, **Zscaler** reported **ScarCruft**’s *Ruby Jumper* campaign using **Zoho WorkDrive** for C2 and removable media components to reach air-gapped systems, while another Zscaler report analyzed **Dust Specter** targeting Iraqi government officials with password-protected RAR delivery and modular implants. **Qianxin XLab** assessed sanctioned infrastructure provider **Funnull** resurfacing to support scam/criminal supply chains and potential **MacCMS**-related supply-chain activity, and **F5 Labs** summarized **APT42**’s **TAMECAT** PowerShell backdoor focused on Edge/Chrome credential theft with C2 over Telegram/Discord/HTTPS and specific file/hash indicators. (A separate Help Net Security item on a Microsoft Defender onboarding tool is product/administrative news and not part of the threat-campaign reporting.)
Jun 29, 2026
North Korean threat actors have expanded from distinct intrusion sets into overlapping cyber operations that mix espionage, financial theft, and targeted ransomware while reusing malware, infrastructure, and delivery tradecraft. Research across Lazarus, Kimsuky, APT43, and related DPRK-linked clusters shows campaigns against governments, think tanks, defense-linked individuals, banks, cryptocurrency firms, and South Korea-focused political and academic targets. Analysts tied these operations to spear-phishing with Word, HWP, ZIP, and password-protected archive lures; trojanized cryptocurrency software in the **AppleJeus** family; bank intrusions associated with **Bluenoroff** and SWIFT fraud; and crypto theft campaigns such as **CryptoCore**. Trellix also linked several narrowly targeted ransomware families to North Korea’s financial cyber apparatus, reinforcing the regime’s dual use of cyber operations for intelligence collection and revenue generation. Recent reporting shows attribution is becoming harder because DPRK operators increasingly share tools and infrastructure across sub-clusters and adapt quickly to evade detection. Kimsuky campaigns used **AppleSeed**, **AlphaSeed**, **GoldDragon**, and **DEEP#GOSU** infection chains with cloud-hosted staging, `mshta.exe`, PowerShell, VBS, Dropbox, Google Docs, fake Blogspot pages, and strict victim-validation logic, while a later Korea-focused phishing operation combined Facebook, email, and Telegram to deliver obfuscated JSE malware. Separate analysis described a late-2023 crypto supply-chain intrusion delivering the **Durian** Golang RAT with signs of collaboration between Kimsuky and Andariel, and another case where **PEBBLEDASH**, long associated with Lazarus, appeared alongside Kimsuky-linked infrastructure. Researchers concluded that malware names alone no longer reliably identify the operator and that accurate attribution now depends on reconstructing the full intrusion chain, infrastructure, targeting, and strategic objective.
Aug 15, 2026