# North Korean TAINTEDSCRIBE trojan analyzed by CISA

Published: 2025-07-17 · Severity: routine · Sectors: government-national, defense, financial-services, energy, infrastructure
Canonical: https://vorant.io/reports/da7d3178-e6ea-5be1-a642-53f00450d48d/north-korean-taintedscribe-trojan-analyzed-by-cisa

> CISA released malware analysis of TAINTEDSCRIBE, a North Korean trojan disguised as Narrator that beacons to C2 and downloads command modules.

CISA, FBI, and DoD jointly analyzed TAINTEDSCRIBE, a full-featured beaconing implant attributed to North Korea's HIDDEN COBRA operation. The malware masquerades as Microsoft's Narrator executable and maintains persistence by copying itself to the user's Startup folder. It contacts hardcoded C2 servers at 211.192.239.232:8443 and downloads command execution modules to perform reconnaissance, file operations, process management, and shell access. The trojan uses FakeTLS for session obfuscation and LFSR encryption for data protection, making detection more difficult. FBI has high confidence that HIDDEN COBRA actors deploy this malware with proxy infrastructure to maintain persistent network access and enable further exploitation. The analysis includes file hashes, network indicators, packet structures, and a Snort rule for detection of the FakeTLS encrypted handshake.

## Mentioned in this report

- Threat actors: Lazarus Group
- Malware: TAINTEDSCRIBE

## Detection guidance (public sample)

### Narrator.exe Dropped in User Startup Folder

ATT&CK: T1547.001

Detects a file named Narrator.exe written to a Startup folder, matching TAINTEDSCRIBE persistence that copies itself there while masquerading as Microsoft Narrator. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Narrator.exe Dropped in User Startup Folder
description: Detects creation of a file named Narrator.exe inside a Windows Startup
  folder. The legitimate Narrator binary lives in System32 and is never placed in
  Startup. TAINTEDSCRIBE copies itself there under this name for persistence.
tags:
- attack.persistence
- attack.t1547.001
- attack.stealth
- attack.t1036.005
logsource:
  category: file_event
  product: windows
detection:
  selection:
    TargetFilename|contains: \Start Menu\Programs\Startup\
    TargetFilename|endswith: \Narrator.exe
  condition: selection
falsepositives:
- An administrator deliberately creating a Narrator shortcut-style copy in Startup
  for accessibility, which is very rare
level: high
id: 84946fbe-7974-5df4-b7e8-88712a23d773
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/analysis-reports/ar20-133b
```

### Narrator.exe Executed From Non-System Location

ATT&CK: T1547.001

Detects Narrator.exe launched from outside the standard Windows system directories, e.g. from the Startup folder, as with the masquerading TAINTEDSCRIBE implant. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Narrator.exe Executed From Non-System Location
description: Detects a process named Narrator.exe whose image path is not in System32,
  SysWOW64 or WinSxS. TAINTEDSCRIBE masquerades as Narrator and runs from the user's
  Startup folder after logon.
tags:
- attack.persistence
- attack.t1547.001
- attack.stealth
- attack.t1036.005
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: \Narrator.exe
  filter_legit:
    Image|startswith:
    - C:\Windows\System32\
    - C:\Windows\SysWOW64\
    - C:\Windows\WinSxS\
  condition: selection and not filter_legit
falsepositives:
- Windows servicing or imaging tools running Narrator from a temporary mounted image
  path
level: high
id: 22a81420-450a-5219-8cb4-45425d278b19
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/analysis-reports/ar20-133b
```

### Narrator.exe Initiating Outbound Network Connection

ATT&CK: T1071.001

Detects Narrator.exe making outbound network connections, which the legitimate accessibility tool does not normally do. TAINTEDSCRIBE beacons to its C2 under this name. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Narrator.exe Initiating Outbound Network Connection
description: Detects Narrator.exe initiating network connections to non-private addresses.
  The legitimate Narrator rarely makes such connections, whereas the TAINTEDSCRIBE
  implant masquerades as Narrator and beacons to a hardcoded C2 over a FakeTLS channel.
tags:
- attack.command-and-control
- attack.t1071.001
- attack.t1041
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Image|endswith: \Narrator.exe
    Initiated: 'true'
  filter_private:
    DestinationIp|cidr:
    - 10.0.0.0/8
    - 172.16.0.0/12
    - 192.168.0.0/16
    - 127.0.0.0/8
  condition: selection and not filter_private
falsepositives:
- Narrator downloading online voice packs or contacting Microsoft services, which
  should go to known Microsoft destinations
level: medium
id: 473cf143-584b-5c75-bdd7-4fde6f22220b
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/analysis-reports/ar20-133b
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

2 more detections for this report are in the app: the rules that match its indicators, the Sigma rules already converted to Splunk SPL, to Elastic where their fields map onto Elastic's integrations and to Microsoft Defender XDR KQL wherever Defender records the activity, and the YARA and Suricata. A new account gets three days of them free.

Source reporting: https://www.cisa.gov/news-events/analysis-reports/ar20-133b

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/da7d3178-e6ea-5be1-a642-53f00450d48d/north-korean-taintedscribe-trojan-analyzed-by-cisa.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup