# North Korean TYPEFRAME RAT and proxy trojans

Published: 2025-07-17 · Severity: routine · Sectors: government-national, defense, technology
Canonical: https://vorant.io/reports/dfbf0946-585c-58d0-b362-f535682f27cf/north-korean-typeframe-rat-and-proxy-trojans

> CISA analysis of North Korean TYPEFRAME malware: droppers, RATs, and proxy modules for persistence, C2 communication, and firewall manipulation.

This Malware Analysis Report (MAR) from CISA and FBI documents TYPEFRAME, a suite of trojans attributed to North Korean government cyber operations (HIDDEN COBRA). The analysis covers 11 malware samples including 32-bit and 64-bit Windows executables and a weaponized Word document with VBA macros. The toolkit is designed to establish persistent backdoor access, install remote access trojans (RATs), deploy proxy modules to convert compromised systems into relay nodes, and modify Windows Firewall rules to permit inbound connections. Droppers embed encrypted modules using RC4 encryption with consistent keys across variants. The malware communicates with C2 servers using crafted TLS sessions with public SSL certificates. RAT modules perform reconnaissance, file operations, process execution with elevated privileges, and service manipulation.

## Mentioned in this report

- Threat actors: Lazarus Group
- Malware: TYPEFRAME, dwnhost.dll, laxhost.dll, midimapper.rs, printcache.tlb
- Campaigns: HIDDEN COBRA

## Detection guidance (public sample)

### Netsh Firewall Rule Added to Allow Inbound Connections

ATT&CK: T1112

netsh.exe adding an inbound-allow firewall rule or an allowed program, as TYPEFRAME does so its RAT and proxy modules can accept inbound connections. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Netsh Firewall Rule Added to Allow Inbound Connections
description: Detects netsh.exe creating an inbound allow rule or an allowed-program
  entry in Windows Firewall. TYPEFRAME droppers and proxy modules modify firewall
  rules to permit inbound connections to the implant. The rule matches the command
  pattern, not a campaign-specific rule name or program path.
tags:
- attack.defense-impairment
- attack.t1112
- attack.t1090.002
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith: \netsh.exe
  selection_adv:
    CommandLine|contains|all:
    - advfirewall
    - add rule
    - dir=in
    - action=allow
  selection_legacy:
    CommandLine|contains|all:
    - firewall
    - add allowedprogram
  condition: selection_img and (selection_adv or selection_legacy)
falsepositives:
- Software installers or game launchers that register inbound firewall exceptions
  for their own binaries
- Administrators or GPO startup scripts opening ports for legitimate services
level: medium
id: 4bb13926-85e7-584f-91cb-866463fbc670
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/analysis-reports/ar18-165a
```

### Office Application Spawning Command Shell or Script Interpreter

ATT&CK: T1204.002

Word, Excel or PowerPoint spawning cmd, script hosts or LOLBins, as a weaponized document with VBA macros does when dropping a TYPEFRAME loader. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Office Application Spawning Command Shell or Script Interpreter
description: Detects Microsoft Office processes spawning cmd.exe, PowerShell, script
  hosts or common LOLBins. This is typical of a weaponized Word document with VBA
  macros that drops and runs a backdoor dropper, as in the TYPEFRAME delivery chain.
tags:
- attack.execution
- attack.t1204.002
- attack.t1059.003
- attack.t1566.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
    - \WINWORD.EXE
    - \EXCEL.EXE
    - \POWERPNT.EXE
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \wscript.exe
    - \cscript.exe
    - \mshta.exe
    - \rundll32.exe
    - \regsvr32.exe
  condition: selection
falsepositives:
- Legitimate Office macros or add-ins that call cmd.exe for business automation
- Document management plugins launching helper scripts
level: high
id: d7b8b115-363a-5e9f-a5c0-4c212822e328
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/analysis-reports/ar18-165a
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

2 more detections for this report are in the app: the rules that match its indicators, the Sigma rules already converted to Splunk SPL, to Elastic where their fields map onto Elastic's integrations and to Microsoft Defender XDR KQL wherever Defender records the activity, and the YARA and Suricata. A new account gets three days of them free.

Source reporting: https://www.cisa.gov/news-events/analysis-reports/ar18-165a

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/dfbf0946-585c-58d0-b362-f535682f27cf/north-korean-typeframe-rat-and-proxy-trojans.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup