NEXUS8by 8bitsecurity
SearchSignalRadarIOCsWatchlist
Sign inPremium
SearchSignalRadarIOCsWatchlist
Sign inPremium
Search/HotCroissant
● Malware

HotCroissant

HotCroissant is a remote access trojan (RAT) attributed by U.S. government entities to malicious North Korean government cyber activity, tracked collectively as HIDDEN COBRA. HotCroissant shares numerous code similarities with Rifdoor.

View graph Watch Export
Indicators tracked
0
Intelligence Reports20
20 intelligence reports available

Curated threat research and citations from CrowdStrike, Mandiant, Microsoft, and other sources — unlock with Premium.

Upgrade to Premium
Connections
22 relationships
T1053.005: Scheduled Task
source
T1113: Screen Capture
source
T1033: System Owner/User Discovery
source
T1027.013: Encrypted/Encoded File
source
T1489: Service Stop
source
T1573.001: Symmetric Cryptography
source
T1007: System Service Discovery
source
T1082: System Information Discovery
source
T1106: Native API
source
T1010: Application Window Discovery
source
T1016: System Network Configuration Discovery
source
T1083: File and Directory Discovery
source
T1057: Process Discovery
source
T1041: Exfiltration Over C2 Channel
source
T1564.003: Hidden Window
source
T1059.003: Windows Command Shell
source
T1070.004: File Deletion
source
T1027.002: Software Packing
source
T1518: Software Discovery
source
T1105: Ingress Tool Transfer
source
Nexus8 is a project by 8bitsecurity.com
Privacy PolicyTerms of ServiceCookie PolicyContact·LinkedInTelegramMastodon