Torisma — Malware Profile

Torisma is a second stage implant designed for specialized monitoring that has been used by Lazarus Group. Torisma was discovered during an investigation into the 2020 Operation North Star campaign that targeted the defense sector.

MITRE ATT&CK techniques (13)

• T1016 System Network Configuration Discovery
• T1027.002 Software Packing
• T1027.013 Encrypted/Encoded File
• T1041 Exfiltration Over C2 Channel
• T1049 System Network Connections Discovery
• T1071.001 Web Protocols
• T1106 Native API
• T1124 System Time Discovery
• T1132.001 Standard Encoding
• T1140 Deobfuscate/Decode Files or Information
• T1480 Execution Guardrails
• T1573.001 Symmetric Cryptography
• T1680 Local Storage Discovery

IntelFusions coverage

• Lazarus Group (APT38): North Korea's Most Prolific Cyber Threat Actor Targets Banks, Crypto, and Critical Infrastructure 2026-02-16

Read the full analysis on IntelFusions