# ELECTRICFISH: North Korean tunneling tool analysis

Published: 2025-07-17 · Severity: routine · Sectors: defense, government-national
Canonical: https://vorant.io/reports/98b012d7-83fd-59d1-a846-0e44f5a04803/electricfish-north-korean-tunneling-tool-analysis

> CISA and FBI analyzed ELECTRICFISH, a North Korean custom tunneling malware enabling traffic relay between systems with proxy bypass capability.

CISA and FBI jointly analyzed ELECTRICFISH, a malicious Windows 32-bit executable used by North Korean government-affiliated actors under the HIDDEN COBRA campaign designation. The malware implements a custom tunneling protocol to relay traffic between two IP addresses, accepting command-line arguments to configure source, destination, and proxy server parameters. The tool continuously attempts to establish TCP sessions with configured endpoints and, once both connections succeed, tunnels traffic between them using a custom protocol with largely static packet headers distinguished by two random bytes. A key capability is proxy authentication support, allowing the malware to bypass network authentication requirements and reach external destinations from systems behind proxy servers. The malware is deployed as a standalone command-line utility and appears designed for lateral movement and exfiltration from compromised networks. CISA recommends organizations flag and prioritize any associated activity for mitigation, following NIST SP 800-83 guidance on malware incident prevention.

## Mentioned in this report

- Threat actors: Lazarus Group
- Malware: ELECTRICFISH
- Campaigns: HIDDEN COBRA

## Detection guidance (public sample)

### Command-Line Tunneling Utility Launched from Writable Path with Multiple IP Endpoints

ATT&CK: T1572

Detects an executable run from a user-writable directory with two or more IPv4 address arguments on its command line, the pattern of a standalone tunneling or relay tool configured with source, destination and proxy endpoints (ELECTRICFISH-style). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Command-Line Tunneling Utility Launched from Writable Path with Multiple IP
  Endpoints
id: 9afb72e6-ffa8-5331-897e-bbd7bfc80551
status: experimental
description: Detects a standalone executable launched from a user-writable directory
  with two or more IPv4 endpoints (optionally with ports) on its command line. This
  matches tunneling or relay tools such as ELECTRICFISH, which take source, destination
  and proxy parameters as arguments and relay TCP traffic between them. Generalises
  on the argument pattern and execution location, not on a specific file name or hash.
  Hunting-grade, so tune per environment.
references:
- https://www.cisa.gov/news-events/analysis-reports/ar19-129a
tags:
- attack.command-and-control
- attack.t1572
- attack.t1090.001
- attack.t1571
- attack.lateral-movement
- attack.t1570
logsource:
  category: process_creation
  product: windows
detection:
  selection_path:
    Image|contains:
    - \Users\Public\
    - \ProgramData\
    - \AppData\Local\Temp\
    - \Windows\Temp\
    - \PerfLogs\
    - \$Recycle.Bin\
  selection_args:
    CommandLine|re: (?:\d{1,3}\.){3}\d{1,3}(?::|\s+)?\d{0,5}.*\s(?:\d{1,3}\.){3}\d{1,3}(?::|\s+)?\d{0,5}
  filter_system_tools:
    Image|endswith:
    - \ping.exe
    - \tracert.exe
    - \nslookup.exe
  condition: selection_path and selection_args and not filter_system_tools
falsepositives:
- Portable network diagnostic or port-forwarding utilities run by administrators from
  temp or public folders
- Software installers launched from temp that receive server IP addresses as arguments
level: medium
author: Vorant
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

1 more detection for this report is in the app: the rules that match its indicators, the Sigma rules already converted to Splunk SPL, to Elastic where their fields map onto Elastic's integrations and to Microsoft Defender XDR KQL wherever Defender records the activity, and the YARA and Suricata. A new account gets three days of them free.

Source reporting: https://www.cisa.gov/news-events/analysis-reports/ar19-129a

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/98b012d7-83fd-59d1-a846-0e44f5a04803/electricfish-north-korean-tunneling-tool-analysis.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup