BADCALL — Malware Profile

BADCALL is a Trojan malware variant used by the group Lazarus Group.

MITRE ATT&CK techniques (8)

• T1001.003 Protocol or Service Impersonation
• T1016 System Network Configuration Discovery
• T1082 System Information Discovery
• T1090 Proxy
• T1112 Modify Registry
• T1571 Non-Standard Port
• T1573.001 Symmetric Cryptography
• T1686.003 Windows Host Firewall

IntelFusions coverage

• Lazarus Group (APT38): North Korea's Most Prolific Cyber Threat Actor Targets Banks, Crypto, and Critical Infrastructure 2026-02-16

Attributed threat actors

• Lazarus Group

Read the full analysis on IntelFusions