Loading malware…
Hidden Cobra is a designation used for North Korean malicious cyber activity associated with the Lazarus Group. In the supplied context, it is tied to a Lazarus-linked intrusion set targeting Windows environments through malicious Office documents crafted for Russian-speaking victims. The documented infection chain used macro-enabled documents, sometimes bundled with a benign decoy PDF, to download and execute an updated KEYMARBLE payload. In some cases the macros retrieved an intermediate VBS downloader; in others they directly fetched the final backdoor. The payload was packaged in a CAB archive disguised as an image and extracted with native Windows tooling before execution.
The malware functionality described for this activity aligns with a backdoor or remote administration implant. KEYMARBLE supports encrypted command-and-control communications and a broad range of operator tasking, including shell command execution, directory and drive enumeration, process listing and termination, file upload and download, archive creation, secure file deletion, file movement, timestamp copying, and host reconnaissance. Communications were implemented with wolfSSL and the malware repeatedly attempted to reconnect to its controller until successful. The implant also used runtime decryption of API names and compression routines to support stealth and data theft operations.
This activity is notable for victimology that differs from Lazarus’s more commonly reported focus, while still showing tradecraft and tooling overlap consistent with the group. The targeted platform in the described campaign is Windows, and the observed behavior supports post-compromise remote control, reconnaissance, defense evasion, and exfiltration capabilities.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Sometimes referred to as Hidden Cobra, Lazarus is one of the most prevalent and active APT groups in the world today.
1 distinct technique documented for this family, organized by ATT&CK tactic.
12 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Associated Analytic Story ... Hidden Cobra Malware
Associated Analytic Story AWS Network ACL Activity Data Protection Dynamic DNS Hidden Cobra Malware Suspicious AWS Traffic Suspicious DNS Traffic Command And Control
Associated Analytic Story Hidden Cobra Malware
Associated Analytic Story DHS Report TA18-074A Disabling Security Tools Emotet Malware DHS Report TA18-201A Hidden Cobra Malware Netsh Abuse Ransomware
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.