Loading malware…
MISTPEN is a lightweight in-memory downloader and backdoor associated with North Korea-linked Lazarus activity, including Operation Dream Job espionage campaigns. It has been used against defense, aerospace, aviation, and other high-value organizations, with confirmed targeting in Europe, India, Brazil, and other regions. The malware is commonly delivered through recruiter-themed social engineering, including fake job offers, malicious PDF lures, trojanized PDF viewers, and DLL sideloading chains.
On execution, MISTPEN runs primarily in memory and communicates with attacker-controlled storage through the Microsoft Graph API and OneDrive, allowing it to blend malicious traffic with legitimate cloud services. It retrieves additional modules and reflectively loads them in memory, supporting modular post-compromise operations. Reported modules perform host profiling, process and system reconnaissance, screenshot capture, persistence establishment, and retrieval of privilege-escalation components. In observed Lazarus intrusion chains, MISTPEN was used before exploitation of CVE-2026-68820 in the Windows AFD.sys driver, after which attackers deployed FudModule and additional implants such as ForestTiger. Some reporting also describes MISTPEN being delivered via the BURNBOOK launcher in earlier Dream Job operations.
MISTPEN is part of a broader Lazarus tradecraft pattern emphasizing stealth, memory-resident execution, staged payload delivery, and use of trusted services for command-and-control. Its role is primarily to profile victims, fetch follow-on tooling, and enable deeper compromise while reducing on-disk artifacts and improving operational flexibility.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
The attacks have been discovered to take use of CVE-2026-68820 (CVSS score: 7.0), a privilege escalation vulnerability that affects the Windows Ancillary Function Driver for WinSock ("AFD.sys"), which Microsoft fixed as part of their August 2026 Patch Tuesday upgrades. | ...it secretly downloads and runs in memory in a lightweight downloader called MISTPEN.
Attackers deployed MISTPEN, Troy RAT, ForestTiger, and FudModule, including the exploitation of the CVE-2026-68820 zero-day in Windows AFD.sys for local privilege escalation and SYSTEM-level access.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
...it secretly downloads and runs in memory in a lightweight downloader called MISTPEN.
21 distinct techniques documented for this family, organized by ATT&CK tactic.
MISTPEN, an in-memory downloader that communicates via attacker-controlled files on OneDrive using the Microsoft Graph API.
Operation Dream Job campaign targeting the defense, aerospace, and aviation sectors through spear-phishing, job-offer lures, impersonation websites, SEO poisoning, and trojanized PDF viewers.
Check Point researchers found the group using fake employment opportunities aimed heavily at defense, aerospace, aviation, drone, robotics, and military technology organizations.
Chaîne 1 – DLL sideloading : archive chiffrée contenant un viewer PDF légitime signé numériquement, une DLL malveillante et un payload chiffré.
archive chiffrée contenant un viewer PDF légitime signé numériquement, une DLL malveillante et un payload chiffré... le payload est déchiffré
Les attaquants usurpent l’identité de recruteurs... proposant de fausses offres d’emploi auprès d’entreprises reconnues... viewer PDF légitime signé numériquement... sites usurpant l’identité d’Enveil.
The downloaders work with hacker controlled infrastructure via Microsoft Graph API and OneDrive
MISTPEN, a lightweight downloader that communicates through Microsoft Graph API and OneDrive.
48 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
25 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A lightweight in-memory downloader used in the intrusion chain to communicate with attacker-controlled infrastructure via Microsoft Graph API and OneDrive and retrieve additional espionage and persistence modules.
A Lazarus-linked downloader/backdoor used in the Operation Dream Job campaign. It communicates through Microsoft Graph API and OneDrive, performs reconnaissance and persistence, and exploits CVE-2026-68820 to gain kernel access and facilitate follow-on payload deployment.
Loader/dropper component delivered via trojanized PDF viewers and malicious PDF documents, used to fetch additional payloads including backdoors through Microsoft Graph/OneDrive infrastructure.
A lightweight downloader used in the infection chain to communicate through Microsoft Graph API and OneDrive, run reconnaissance modules, trigger the AFD.sys exploit, and deploy follow-on payloads.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.