SIGNBT

SIGNBT is a Lazarus-associated Windows backdoor used in multi-stage intrusions against organizations in South Korea and in operations linked to the TraderTraitor cluster. It has been observed as an in-memory initial implant and as part of watering-hole exploitation chains that abused vulnerabilities in widely deployed South Korean financial and security software. In these campaigns, compromised legitimate websites selectively redirected targets to exploit content that triggered remote code execution through local software components, after which SIGNBT or the related COPPERHEDGE backdoor was loaded without requiring a conventional download prompt. SIGNBT has also been reported in Lazarus operations targeting software vendors and in updated TraderTraitor activity.

Operationally, SIGNBT is used to establish covert control of compromised systems and to stage follow-on malware. Documented variants include early builds such as version 0.0.1 and later versions such as 1.2 and 3.0 mappings reported by defenders. Version 0.0.1 was observed executing in memory inside a legitimate Windows process to fetch additional malware, while later variants were described as focused on executing additional payloads. Across reporting, SIGNBT supports remote command execution, delivery of further implants, file theft, internal reconnaissance, and process injection. Some intrusion chains stored encrypted configuration data in the Windows registry and decrypted later stages only in memory, reflecting a fileless or low-artifact design intended to reduce forensic visibility.

The malware’s tradecraft is consistent with Lazarus tooling. Analysts have noted use of TLS callbacks as an evasion mechanism also seen in other Lazarus families, as well as recurring in-memory PE loading and overlap with DLL sideloading-centric execution chains in adjacent malware clusters. In South Korean watering-hole operations, payloads associated with SIGNBT were injected into legitimate Microsoft processes, and subsequent activity included privilege escalation, credential access tooling, and lateral movement by the operators. SIGNBT therefore functions less as a standalone end-state payload than as a stealthy foothold and execution platform within broader espionage and financially motivated campaigns.

Victimology tied to SIGNBT includes South Korean software, IT, financial, semiconductor manufacturing, telecommunications, healthcare, education, manufacturing, and news-related environments reached through compromised trusted websites and local software exploitation. Its association with Lazarus and TraderTraitor places it within a broader ecosystem of North Korean operations spanning espionage, supply-chain compromise, and cryptocurrency-focused intrusion activity.