ThreatNeedle — Malware Profile

ThreatNeedle is a backdoor that has been used by Lazarus Group since at least 2019 to target cryptocurrency, defense, and mobile gaming organizations. It is considered to be an advanced cluster of Lazarus Group's Manuscrypt (a.k.a. NukeSped) malware family.

MITRE ATT&CK techniques (14)

• T1005 Data from Local System
• T1027.011 Fileless Storage
• T1027.013 Encrypted/Encoded File
• T1027.015 Compression
• T1036.005 Match Legitimate Resource Name or Location
• T1082 System Information Discovery
• T1083 File and Directory Discovery
• T1105 Ingress Tool Transfer
• T1112 Modify Registry
• T1140 Deobfuscate/Decode Files or Information
• T1204.002 Malicious File
• T1543.003 Windows Service
• T1547.001 Registry Run Keys / Startup Folder
• T1566.001 Spearphishing Attachment

IntelFusions coverage

• Lazarus Group (APT38): North Korea's Most Prolific Cyber Threat Actor Targets Banks, Crypto, and Critical Infrastructure 2026-02-16

Attributed threat actors

• Lazarus Group

Read the full analysis on IntelFusions