KEYMARBLE — Malware Profile

KEYMARBLE is a Trojan that has reportedly been used by the North Korean government.

MITRE ATT&CK techniques (11)

• T1016 System Network Configuration Discovery
• T1057 Process Discovery
• T1059.003 Windows Command Shell
• T1070.004 File Deletion
• T1082 System Information Discovery
• T1083 File and Directory Discovery
• T1105 Ingress Tool Transfer
• T1112 Modify Registry
• T1113 Screen Capture
• T1573.001 Symmetric Cryptography
• T1680 Local Storage Discovery

IntelFusions coverage

• Lazarus Group (APT38): North Korea's Most Prolific Cyber Threat Actor Targets Banks, Crypto, and Critical Infrastructure 2026-02-16

Attributed threat actors

• Lazarus Group

Read the full analysis on IntelFusions