Article
The Lazarus Group: Espionage, Sabotage, and Cybercrime Under One Umbrella
Lazarus Group profile: active since at least 2009, with aliases and major incidents such as Sony Pictures, WannaCry and Bybit, plus defense guidance.
Read more
Malware profile
HOPLIGHT
HOPLIGHT is a backdoor Trojan for Windows.
In short
HOPLIGHT is a backdoor Trojan for Windows. MITRE ATT&CK says it has reportedly been used by the North Korean government. CISA and the FBI published an analysis report on it in April 2019, and a 2020 joint advisory said the US Government had found it on victim systems, which suggested a bank-targeting group was using it.
- Names1names in public reportsHOPLIGHT
- Techniques19ATT&CK techniques listedCredential Access · Lateral Movement · Command and Control
- Infection Steps4in the delivery chainHook the security process · Drop a library
- Linked Groups2groups that use itAPT38 · Lazarus Group
In one minute
- What it is
- A backdoor Trojan for Windows that MITRE says has reportedly been used by the North Korean government.
- What it does
- Collects system details, runs commands, injects into running processes, and uploads and downloads files. Proxy applications hide its traffic behind fake TLS sessions.
- Who uses it
- Described by DHS and the FBI (report AR19-100A, 10 April 2019) as used by the North Korean government. Advisory AA20-239A (August 2020) says the US Government found it on victim systems, suggesting the BeagleBoyz are using it. MITRE lists APT38 and Lazarus Group.
- How it gets in
- No cited government source says how it first gets onto a system.
- What to do first
- Check systems and network logs against the indicators and YARA rules in CISA report AR19-100A (MAR-10135536-8).
What it does
The CISA and FBI analysis report covers nine malicious files. Seven are proxy applications that mask traffic between the malware and the remote operators. They can generate fake TLS handshake sessions using valid public SSL certificates, which disguises the connections.
The 2020 advisory AA20-239A adds that HOPLIGHT has the same basic remote access functions as another tool named CROWDEDFLOUNDER. It says the fraudulent TLS sessions make the malware's communications hard to detect and track.
Names
Public sources use several names for this malware.
| Name | Where it appears |
|---|---|
| HOPLIGHT | MITRE ATT&CK software S0376, CISA analysis report AR19-100A (MAR-10135536-8) and advisory AA20-239A[1, 2, 3] |
What it can do
What MITRE ATT&CK lists this malware as doing, by tactic. Each id opens our technique page where one exists, otherwise MITRE.
Credential Access
Lateral Movement
Command and Control
Fallback Channels T1008
It has several command channels in place in case one fails.[1]
Proxy T1090
It has several proxy options that mask traffic between the malware and its operators.[1, 2]
Ingress Tool Transfer T1105
It can connect to a remote host to upload and download files.[1, 2]
Data Encoding: Standard Encoding T1132.001
It has used Zlib compression to obscure the content of its communications.[1, 2]
Non-Standard Port T1571
It has connected outbound over TCP port 443 using a fake TLS method.[1, 2]
Exfiltration
Execution
Persistence
Defense Impairment
Discovery
Query Registry T1012
One variant hooks lsass.exe, which then checks the registry for the value rdpproto in the Lsa key.[1, 2]
System Information Discovery T1082
It has collected victim machine details such as the OS version.[1, 2]
File and Directory Discovery T1083
Device Driver Discovery T1652
It can list device drivers that are stored in the registry under HKLM\Software\WBEM\WDM.[1, 2]
How it spreads
No government source cited here says how HOPLIGHT first reaches a victim. The analysis report describes the files themselves: in one 64-bit variant, an executable drops a library into the System32 folder. Advisory AA20-239A says the bank-targeting group it describes selectively exploits systems after first compromising a computer connected to a financial institution's corporate network.
How an infection runs
The order of steps in a typical infection, as the sources describe it.
Hook the security process
In one analyzed 64-bit variant, the malware hooks the Windows Local Security Authority process (lsass.exe), which checks the registry for a value and adds it if it is missing.[2]
Drop a library
The malware drops an embedded library file into the System32 folder.[2]
Write a data file
A data file is then written to C:\Windows. It holds the addresses the malware calls out to.[2]
Call out
The malware attempts outbound connections to the address pairs in that file, and the dropped library sends SSL Client Hello packets to its own embedded addresses.[2]
Timeline
- October 2018
FASTCash and CROWDEDFLOUNDER
AA20-239A says analysis of CROWDEDFLOUNDER, a tool with the same basic remote access functions as HOPLIGHT, was first released in October 2018 as part of the FASTCash campaign.[3]
- April 10, 2019
CISA and FBI analysis report
MAR-10135536-8 (AR19-100A) was released as the first version of the HOPLIGHT analysis. It covers nine files and says HOPLIGHT variants are used by the North Korean government.[2]
- February 2020
Bank targeting resumes
AA20-239A says North Korea has resumed targeting banks in multiple countries since February 2020.[3]
- August 26, 2020
Joint advisory AA20-239A
CISA, Treasury, FBI and US Cyber Command published the advisory. It says the US Government has found HOPLIGHT on victim systems, suggesting the BeagleBoyz are using it.[3]
Who uses it
- Threat group APT38 APT38 is a North Korean state-sponsored group focused on financial theft, attributed by MITRE ATT&CK to North Korea's Reconnaissance General Bureau. North Korea · Since 2014
- Threat group Lazarus Group Lazarus Group is the name used by MITRE, the US Treasury and the US Department of Justice for North Korean hacking units that, they say, work for the Reconnaissance General Bureau. North Korea · Since 2009
Detection and defense
Questions
What is HOPLIGHT?
MITRE ATT&CK calls it a backdoor Trojan that has reportedly been used by the North Korean government. CISA and the FBI released an analysis report on it, MAR-10135536-8, on 10 April 2019.
Who is behind HOPLIGHT?
Sources differ in detail. DHS and the FBI say the variants were used by the North Korean government. Advisory AA20-239A says the US Government found HOPLIGHT on victim systems, suggesting the BeagleBoyz group is using it, and that this group overlaps to varying degrees with groups tracked as Lazarus and APT38. MITRE lists APT38 and Lazarus Group and warns that North Korean group definitions overlap significantly.
How does HOPLIGHT hide its traffic?
CISA says seven of the nine files it analyzed are proxy applications that can generate fake TLS handshake sessions using valid public SSL certificates, which disguises the connection to the remote operators.
Where are the official detection resources?
CISA report AR19-100A (MAR-10135536-8) includes indicators in a STIX file and YARA rules. Advisory AA20-239A points to it and to other malware analysis reports.
Do the US charges against North Korean hackers mention HOPLIGHT?
Not in the Department of Justice announcements we read, from September 2018 and February 2021. Both describe the Lazarus Group and APT38 activity but do not name HOPLIGHT.
In our research
- The Lazarus Group: Espionage, Sabotage, and Cybercrime Under One Umbrella October 2025
- APT38 Threat group
Sources
- HOPLIGHT, Software S0376 MITRE ATT&CKSupports: Backdoor Trojan description, Windows, techniques and the groups MITRE lists.
- MAR-10135536-8, North Korean Trojan: HOPLIGHT (AR19-100A) CISASupports: Analysis of nine files, proxy and fake TLS behaviour, capabilities, variant behaviour, indicators, YARA rules and recommendations.
- FASTCash 2.0: North Korea's BeagleBoyz Robbing Banks (AA20-239A) CISA, Treasury, FBI and US Cyber CommandSupports: HOPLIGHT found on victim systems, overlap with other group names, and mitigations.
- North Korean Regime-Backed Programmer Charged With Conspiracy to Conduct Multiple Cyber Attacks and Intrusions US Department of JusticeSupports: September 2018 complaint naming the Lazarus Group.
- Three North Korean Military Hackers Indicted in Wide-Ranging Scheme to Commit Cyberattacks and Financial Crimes Across the Globe US Department of JusticeSupports: February 2021 indictment and the Lazarus Group and APT38 names.
- APT38, Group G0082 MITRE ATT&CKSupports: MITRE lists HOPLIGHT as software of APT38; notes on group overlap.
- Lazarus Group, Group G0032 MITRE ATT&CKSupports: MITRE lists HOPLIGHT as software of Lazarus Group.
Browse the threat library
- APT groups State-backed hacking groups, who they go after and how they get in. 49 profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 profiles
- Ransomware groups How each group gets in, how it extorts and what stops it. 24 profiles
- Malware and tools Malware families and abused tools, what they do and how to spot them. 46 profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 36 profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 44 profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 103 profiles
Stay Ahead of
Digital Threats
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.