Loading threat actor…
REF6598 is a cryptocurrency-focused intrusion cluster associated with a multi-stage attack chain culminating in deployment of the PHANTOMPULSE remote access trojan. The activity has been assessed as closely aligned with DPRK-linked threat activity, particularly clusters tracked as Lazarus, BlueNoroff, UNC5342, Contagious Interview, and APT38, based on targeting, tradecraft, and infrastructure patterns. High-confidence attribution to a specific named DPRK group is not established here, but the cluster is best characterized as North Korea-aligned and financially motivated. The intrusion chain has used abuse of Obsidian plugins for initial delivery, followed by the PHANTOMPULL in-memory loader and then PHANTOMPULSE as the final-stage implant. PHANTOMPULSE is a Windows RAT with extensive post-compromise functionality, including host reconnaissance, persistence, privilege escalation, process injection, keylogging, clipboard monitoring, screenshot capture, command execution, payload deployment, and exfiltration of telemetry and collected data. REF6598 demonstrates strong defense-evasion tradecraft. PHANTOMPULSE uses multiple process-injection methods, including module stomping, Debug API-driven execution, and manual DLL mapping. It also disables or bypasses security visibility mechanisms including AMSI, WLDP, and ETW through hardware breakpoints and vectored exception handling rather than simple inline patching. Additional evasion includes direct-syscall wrappers, layered string and configuration obfuscation, and anti-sandbox checks against known analysis personas. For privilege escalation, the malware uses a documented UAC bypass technique involving elevated COM access to Task Scheduler objects, with fallback relaunch logic through a proxy process. Persistence is maintained through multiple scheduled tasks and self-healing logic that reinstalls persistence if removed or degraded. Command-and-control resilience is a notable feature: the implant can resolve operator infrastructure from blockchain transaction data across multiple networks, with fallback to a conventional panel-based channel. Operationally, REF6598 appears tailored for follow-on theft from cryptocurrency users and related targets. The malware enumerates security products and checks for the presence of cryptocurrency wallet software, messaging clients, authentication tools, file-transfer utilities, and other applications that can support credential theft, wallet compromise, or broader post-exploitation objectives. Overall, REF6598 is a sophisticated crypto-targeting intrusion set with tooling and tradecraft consistent with DPRK-linked financially motivated operations.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
11 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
2 malware families attributed to this actor across reporting.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Threat cluster behind the PHANTOMPULSE attack chain, actively targeting the cryptocurrency sector using Obsidian plugin abuse, an in-memory loader, and a RAT with persistence, process injection, UAC bypass, and blockchain-based C2.
Intrusion set associated with delivery of PHANTOMPULL and PHANTOMPULSE, using Obsidian plugin abuse and a multi-stage Windows toolchain.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.