Loading malware…
Alreay is a Windows banking malware family associated with Lazarus Group activity, particularly financially motivated operations attributed to the Bluenoroff cluster. It has been observed in intrusions against banks and SWIFT-connected environments, including a 2016 compromise of a Southeast Asian financial institution. The malware was used as part of a broader post-compromise toolkit that supported long-term access, covert operation inside bank networks, and manipulation of systems adjacent to payment operations rather than exploitation of SWIFT software itself.
Alreay has been linked to campaigns involving compromise of bank infrastructure, persistence through Windows services, use of privileged execution contexts, and deployment alongside backdoors, tunneling utilities, and SWIFT-focused modules. In these operations, attackers maintained access for extended periods, moved laterally with administrative privileges, used keylogging, proxied traffic through internal relay hosts, and employed anti-forensics measures such as wiping components, splitting functionality across multiple hosts, and rolling back modified files after use. Related Lazarus tooling in the same operations disabled integrity checks and intercepted transaction-processing data on SWIFT-connected systems.
The malware family is tied to financially motivated targeting of banks and other financial organizations. Reporting also places the broader Bluenoroff/Lazarus ecosystem against trading firms, casinos, and cryptocurrency businesses. Alreay is best understood as one component of a tailored intrusion set used in high-value financial theft operations conducted by Lazarus-linked operators.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Lazarus under the Hood Alreay DYEPACK HOTWAX NESTEGG RatankbaPOS REDSHAWL WORMHOLE Lazarus Group
The incident happened in a South East Asian country in August 2016, when Kaspersky Lab products detected new malicious activity from the Trojan-Banker.Win32.Alreay malware family.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Named Lazarus-linked malware/tool discussed in technical reporting.
Banking malware family linked in the report to the Bangladesh-related toolset and later to packed Lazarus/Bluenoroff backdoor samples used in bank intrusions.
Banking malware family linked in the report to the Bangladesh/SWIFT attack tooling and later used as detection naming for packed Lazarus/Bluenoroff backdoor samples.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.