BLINDINGCAN — Malware Profile

BLINDINGCAN is a remote access Trojan that has been used by the North Korean government since at least early 2020 in cyber operations against defense, engineering, and government organizations in Western Europe and the US.

MITRE ATT&CK techniques (22)

• T1005 Data from Local System
• T1016 System Network Configuration Discovery
• T1027.002 Software Packing
• T1027.013 Encrypted/Encoded File
• T1036.005 Match Legitimate Resource Name or Location
• T1041 Exfiltration Over C2 Channel
• T1059.003 Windows Command Shell
• T1070.004 File Deletion
• T1070.006 Timestomp
• T1071.001 Web Protocols
• T1082 System Information Discovery
• T1083 File and Directory Discovery
• T1105 Ingress Tool Transfer
• T1129 Shared Modules
• T1132.001 Standard Encoding
• T1140 Deobfuscate/Decode Files or Information
• T1204.002 Malicious File
• T1218.011 Rundll32
• T1553.002 Code Signing
• T1566.001 Spearphishing Attachment
• T1573.001 Symmetric Cryptography
• T1680 Local Storage Discovery

IntelFusions coverage

• Lazarus Group (APT38): North Korea's Most Prolific Cyber Threat Actor Targets Banks, Crypto, and Critical Infrastructure 2026-02-16

Attributed threat actors

• Lazarus Group

Read the full analysis on IntelFusions