Loading threat actor…
COVELLITE is a Dragos-tracked activity group linked to Lazarus Group activity and, by extension, to North Korean state interests through third-party attribution of Lazarus. The group has targeted electric utility and broader electric energy organizations, compromising IT networks associated with the sector primarily in Europe, East Asia, and North America. Reported operations emphasize enterprise-network intrusion rather than demonstrated industrial-control disruption, and there is no confirmed ICS-specific disruptive capability publicly established for this group. COVELLITE has been observed using hardened anti-analysis malware, encoded binaries embedded in documents, and evasion techniques to gain and maintain access in victim environments. Its tradecraft indicates a focus on stealthy compromise of industrial organizations’ IT environments, consistent with reconnaissance, initial access, persistence, and post-compromise operations inside enterprise networks supporting critical infrastructure. The group has also been described as leveraging capabilities and infrastructure substantially different from WASSONITE, despite both being associated with Lazarus-related activity, and its observed target set does not overlap with WASSONITE. COVELLITE is notable for targeting electric utilities in Europe, the United States, and East Asia. Public reporting ties it to compromises of networks associated with electric energy organizations, but does not establish ransomware or extortion activity. Its known behavior is most consistent with state-linked intrusion activity against critical infrastructure for strategic access and intelligence value rather than financially motivated operations.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
2 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A Dragos activity group associated with Lazarus that used substantially different capabilities and infrastructure from WASSONITE and pursued a non-overlapping target set.
Compromised electric-energy networks across Europe/East Asia/North America; no ICS-specific capability described; not assessed as currently active for electric targeting in this report.
Electric-utility-focused intrusion group using phishing and anti-analysis malware to compromise IT networks associated with industrial organizations, though no recent ICS targeting was observed in this report.
Industrial targeting group using anti-analysis malware, encoded binaries in documents, evasion techniques, and phishing against electric utilities and aerospace victims.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.