# North Korean HOTCROISSANT Trojan malware analysis

Published: 2025-07-17 · Severity: routine
Canonical: https://vorant.io/reports/8f533368-3849-54d5-b378-10f90c979b8d/north-korean-hotcroissant-trojan-malware-analysis

> CISA analysis of HOTCROISSANT, a North Korean beaconing Trojan with system survey, file transfer, and command execution capabilities.

CISA, FBI, and DoD released a Malware Analysis Report (MAR) detailing HOTCROISSANT, a full-featured beaconing implant attributed to North Korean government-sponsored HIDDEN COBRA activity. The malware performs system reconnaissance, file upload and download, process execution, command execution, and screen captures. It uses custom XOR-based network encoding with zipped payload delivery, hardcoded command-and-control infrastructure, and attempts to hide API usage through obfuscated string lookups via LoadLibrary and GetProcAddress. The sample analyzed communicates with C2 at 94.177.123.138:8088 and exhibits several implementation flaws including broken ProcessKill and WindowClose commands due to programmer errors. The malware maintains a persistent beaconing loop after initial victim information transmission.

## Mentioned in this report

- Threat actors: Lazarus Group
- Malware: HotCroissant

## Detection guidance (public sample)

### User-Writable Path Process Connecting Outbound to TCP 8088

ATT&CK: T1071

Detects a process running from a user-writable directory making an outbound connection to a public address on TCP 8088, the non-standard port used by the HOTCROISSANT beacon. It matches the port and execution-location pattern, not the C2 IP. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: User-Writable Path Process Connecting Outbound to TCP 8088
description: Detects a process running from a user-writable directory (AppData, Temp,
  ProgramData, Public) making an outbound connection to a public address on TCP 8088.
  HOTCROISSANT-style beaconing implants use a hardcoded non-standard port for C2.
  Matches the port and execution-location pattern, not the C2 IP.
tags:
- attack.command-and-control
- attack.t1071
- attack.t1041
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Initiated: 'true'
    DestinationPort: 8088
    Image|contains:
    - \AppData\
    - \Users\Public\
    - \ProgramData\
    - \Windows\Temp\
    - \Temp\
  filter_private:
    DestinationIp|cidr:
    - 10.0.0.0/8
    - 172.16.0.0/12
    - 192.168.0.0/16
    - 127.0.0.0/8
    - 169.254.0.0/16
  condition: selection and not filter_private
falsepositives:
- Developer tools or locally installed web apps in AppData that talk to an external
  service on port 8088
- Portable admin or monitoring agents run from ProgramData that use 8088
level: medium
id: 3e1d4506-9e15-5953-8225-d28ea42c0972
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/analysis-reports/ar20-045d
```

### Process from User-Writable Path Spawning cmd.exe for Host Reconnaissance

ATT&CK: T1082

Detects a binary running from a user-writable directory spawning cmd.exe to run host reconnaissance commands, as a beaconing implant would for system discovery and command execution. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Process from User-Writable Path Spawning cmd.exe for Host Reconnaissance
description: Detects a binary executing from a user-writable directory (AppData, Temp,
  ProgramData, Public) that spawns cmd.exe to run host discovery commands. This is
  consistent with a beaconing implant performing system reconnaissance and command
  execution on operator tasking.
tags:
- attack.discovery
- attack.execution
- attack.t1082
- attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|contains:
    - \AppData\
    - \Users\Public\
    - \ProgramData\
    - \Windows\Temp\
  selection_child:
    Image|endswith: \cmd.exe
    CommandLine|contains:
    - systeminfo
    - ipconfig /all
    - tasklist
    - whoami
    - net user
  filter_known_parents:
    ParentImage|contains:
    - \Microsoft\Teams\
    - \Programs\Microsoft VS Code\
    - \Google\Chrome\
  condition: selection_parent and selection_child and not filter_known_parents
falsepositives:
- Software installers or updaters unpacked to Temp that gather system information
- Admin scripts or portable tools launched from a user profile
level: medium
id: bdb1b358-b60e-58c0-8b6d-7014e41704f3
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/analysis-reports/ar20-045d
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

2 more detections for this report are in the app: the rules that match its indicators, the Sigma rules already converted to Splunk SPL, to Elastic where their fields map onto Elastic's integrations and to Microsoft Defender XDR KQL wherever Defender records the activity, and the YARA and Suricata. A new account gets three days of them free.

Source reporting: https://www.cisa.gov/news-events/analysis-reports/ar20-045d

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/8f533368-3849-54d5-b378-10f90c979b8d/north-korean-hotcroissant-trojan-malware-analysis.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup