North Korean TAINTEDSCRIBE trojan analyzed by CISA
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
CISA released malware analysis of TAINTEDSCRIBE, a North Korean trojan disguised as Narrator that beacons to C2 and downloads command modules.
CISA, FBI, and DoD jointly analyzed TAINTEDSCRIBE, a full-featured beaconing implant attributed to North Korea's HIDDEN COBRA operation. The malware masquerades as Microsoft's Narrator executable and maintains persistence by copying itself to the user's Startup folder. It contacts hardcoded C2 servers at 211.192.239.232:8443 and downloads command execution modules to perform reconnaissance, file operations, process management, and shell access. The trojan uses FakeTLS for session obfuscation and LFSR encryption for data protection, making detection more difficult. FBI has high confidence that HIDDEN COBRA actors deploy this malware with proxy infrastructure to maintain persistent network access and enable further exploitation. The analysis includes file hashes, network indicators, packet structures, and a Snort rule for detection of the FakeTLS encrypted handshake.
Mentioned in this report
Detection guidance
Narrator.exe Dropped in User Startup Folder
Detects a file named Narrator.exe written to a Startup folder, matching TAINTEDSCRIBE persistence that copies itself there while masquerading as Microsoft Narrator. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Narrator.exe Dropped in User Startup Folder
description: Detects creation of a file named Narrator.exe inside a Windows Startup
folder. The legitimate Narrator binary lives in System32 and is never placed in
Startup. TAINTEDSCRIBE copies itself there under this name for persistence.
tags:
- attack.persistence
- attack.t1547.001
- attack.stealth
- attack.t1036.005
logsource:
category: file_event
product: windows
detection:
selection:
TargetFilename|contains: \Start Menu\Programs\Startup\
TargetFilename|endswith: \Narrator.exe
condition: selection
falsepositives:
- An administrator deliberately creating a Narrator shortcut-style copy in Startup
for accessibility, which is very rare
level: high
id: 84946fbe-7974-5df4-b7e8-88712a23d773
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/analysis-reports/ar20-133b
Narrator.exe Executed From Non-System Location
Detects Narrator.exe launched from outside the standard Windows system directories, e.g. from the Startup folder, as with the masquerading TAINTEDSCRIBE implant. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Narrator.exe Executed From Non-System Location
description: Detects a process named Narrator.exe whose image path is not in System32,
SysWOW64 or WinSxS. TAINTEDSCRIBE masquerades as Narrator and runs from the user's
Startup folder after logon.
tags:
- attack.persistence
- attack.t1547.001
- attack.stealth
- attack.t1036.005
logsource:
category: process_creation
product: windows
detection:
selection:
Image|endswith: \Narrator.exe
filter_legit:
Image|startswith:
- C:\Windows\System32\
- C:\Windows\SysWOW64\
- C:\Windows\WinSxS\
condition: selection and not filter_legit
falsepositives:
- Windows servicing or imaging tools running Narrator from a temporary mounted image
path
level: high
id: 22a81420-450a-5219-8cb4-45425d278b19
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/analysis-reports/ar20-133b
Narrator.exe Initiating Outbound Network Connection
Detects Narrator.exe making outbound network connections, which the legitimate accessibility tool does not normally do. TAINTEDSCRIBE beacons to its C2 under this name. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Narrator.exe Initiating Outbound Network Connection
description: Detects Narrator.exe initiating network connections to non-private addresses.
The legitimate Narrator rarely makes such connections, whereas the TAINTEDSCRIBE
implant masquerades as Narrator and beacons to a hardcoded C2 over a FakeTLS channel.
tags:
- attack.command-and-control
- attack.t1071.001
- attack.t1041
logsource:
category: network_connection
product: windows
detection:
selection:
Image|endswith: \Narrator.exe
Initiated: 'true'
filter_private:
DestinationIp|cidr:
- 10.0.0.0/8
- 172.16.0.0/12
- 192.168.0.0/16
- 127.0.0.0/8
condition: selection and not filter_private
falsepositives:
- Narrator downloading online voice packs or contacting Microsoft services, which
should go to known Microsoft destinations
level: medium
id: 473cf143-584b-5c75-bdd7-4fde6f22220b
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/analysis-reports/ar20-133b
2 more detections for this report are in the app — the rules that match its indicators, plus the Sigma rules already converted to Splunk SPL, to Elastic where their fields map onto Elastic's integrations and to Microsoft Defender XDR KQL wherever Defender records the activity, and the YARA and Suricata. Three days of it free, no card.
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisa.gov/news-events/analysis-reports/ar20-133b
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs