Loading story…
U.S. authorities and security researchers reported that North Korean HIDDEN COBRA operators deployed the BLINDINGCAN remote access trojan against defense and aerospace organizations in Europe and the United States. The campaign used phishing emails carrying fake job-offer documents themed as material from major contractors such as Boeing, with the lure documents attempting to exploit CVE-2017-0199 to retrieve additional malware.
Once installed, BLINDINGCAN established persistence, conducted host reconnaissance, captured keystrokes and clipboard data, and exfiltrated system information to command-and-control infrastructure. Analysis linked the malware to layered obfuscation and encryption techniques, including AES-encrypted configuration data, XOR decoding, and RC4-encrypted strings, while the FBI assessed with high confidence that the operators used proxy servers and compromised infrastructure in multiple countries to support the operation, which appeared aimed at intelligence collection.
TTPs, infrastructure, and targeting history in one profile.
1 event from the most recent confirmed update back to the earliest known activity.
CISA published Malware Analysis Report AR20-232A / MAR-10295134-1.v1 covering the North Korean BLINDINGCAN remote access trojan. The report documented the malware's delivery via phishing documents exploiting CVE-2017-0199, its reconnaissance and persistence behavior, and related indicators of compromise.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 11 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
North Korea–aligned operators, including **Lazarus** (aka **HIDDEN COBRA**), are running multiple social-engineering-led intrusion campaigns aimed at stealing sensitive technology and establishing durable access. Reporting on **Operation DreamJob** describes fake job-offer lures used to compromise European drone manufacturers and defense contractors, with tooling and infrastructure designed to evade traditional defenses and support cyber-espionage against UAV-related intellectual property. Separately, a developer-focused operation dubbed **“Fake Font”** uses fake recruiter outreach and malicious GitHub repositories to trick engineers into opening projects that abuse *Visual Studio Code* automation (via `.vscode/tasks.json`) and disguised payloads (e.g., `.woff2` “font” files) to execute multi-stage malware that ultimately deploys the **InvisibleFerret** Python backdoor for credential and crypto-wallet theft and long-term access. A distinct DPRK-linked campaign reported by Darktrace targets South Korean users with spear-phishing that delivers a JSE script masquerading as an HWPX document and then abuses **VS Code tunnels** as a covert C2 channel over trusted Microsoft infrastructure, complicating detection in developer-heavy environments. Other items in the set describe unrelated activity: phishing abuse of *Vercel* to deliver remote-access tooling, exploitation of **CVE-2025-51683** (blind SQLi) in the *Mjobtime* time-tracking app to reach MSSQL `xp_cmdshell`, a hospitality-focused **DCRat** campaign using **ClickFix** and `MSBuild.exe`, a generic CSS exfiltration technique write-up, and Trend Micro research on the **PeckBirdy** LOLBins framework used by China-aligned intrusion sets—none of which are part of the DPRK developer/defense recruitment-themed operations above.
Jun 29, 2026
CISA published malware analysis reports covering multiple state-linked implants, including the North Korean **COPPERHEDGE** and **BLINDINGCAN** remote access tools and the **SUNBURST** backdoor tied to the SolarWinds compromise. The reports describe how these malware families were used to establish persistence, conduct reconnaissance, execute arbitrary commands, and exfiltrate data from victim environments, with COPPERHEDGE specifically attributed with high confidence to North Korean **HIDDEN COBRA** actors and linked to campaigns targeting cryptocurrency exchanges and related entities. The technical reporting highlights distinct malware variants, command-and-control patterns, and detection opportunities for defenders. For COPPERHEDGE, CISA documented six variants across Windows DLL samples, noting differences in HTTP beaconing, encryption, and POST formatting, including use of **RC4**, **Base64**, XOR-based encoding, and Google Analytics-like cookies, alongside dozens of associated domains and sample hashes. Across the reports, CISA provided indicators, malware characteristics, and detection guidance such as **YARA** and **Snort** signatures to help organizations identify related activity and prioritize mitigation and reporting.
Jun 29, 2026
Researchers reported that **APT37**/**Reaper** (also tracked as **ScarCruft**) ran a surveillance campaign against **North Korean defectors in South Korea** and **human rights activists**, using credential-harvesting phishing pages and malware-laced lures to collect intelligence. The operation impersonated services including **Naver, iCloud, Kakao, Mail.ru, and 163.com**, and some phishing pages were built to intercept credentials and evade or relay **two-factor authentication** flows through web-based communications channels. Investigators found two exposed Reaper command-and-control servers that revealed both hosted malware and stolen victim data, providing a detailed view of the intrusion set. The campaign used **CHM** files for initial infection, **PowerShell** backdoors, modified DLL loaders, **ExtremeVNC**, and multiple **Chinotto** malware variants, including new Windows DLL samples identified as **CKU** and **DATA**, as well as an **AblyGo** backdoor, indicating ongoing tool development in a sustained North Korea-linked cyberespionage effort.
Aug 15, 2026