MITRE ATT&CKsoftware (malware)

S0520 BLINDINGCAN

Published 2020-10-27 Modified 2025-10-21 Official page ↗
Domain
enterprise
Platforms
Windows
Version
1.2
Created
2020-10-27

Description

BLINDINGCAN is a remote access Trojan that has been used by the North Korean government since at least early 2020 in cyber operations against defense, engineering, and government organizations in Western Europe and the US.

Related

Uses · MITRE ATT&CK (22)

  • T1680 Local Storage Discovery technique
  • T1027.013 Encrypted/Encoded File sub-technique
  • T1573.001 Symmetric Cryptography sub-technique
  • T1071.001 Web Protocols sub-technique
  • T1132.001 Standard Encoding sub-technique
  • T1204.002 Malicious File sub-technique
  • T1059.003 Windows Command Shell sub-technique
  • T1566.001 Spearphishing Attachment sub-technique
  • T1036.005 Match Legitimate Resource Name or Location sub-technique
  • T1027.002 Software Packing sub-technique
  • T1553.002 Code Signing sub-technique
  • T1070.004 File Deletion sub-technique
  • T1070.006 Timestomp sub-technique
  • T1218.011 Rundll32 sub-technique
  • T1140 Deobfuscate/Decode Files or Information technique
  • T1005 Data from Local System technique
  • T1016 System Network Configuration Discovery technique
  • T1041 Exfiltration Over C2 Channel technique
  • T1082 System Information Discovery technique
  • T1083 File and Directory Discovery technique
  • T1105 Ingress Tool Transfer technique
  • T1129 Shared Modules technique

Referenced by MITRE ATT&CK · uses (1)

  • G0032 Lazarus Group group

References