H3XA — Operational Evidence

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[BLINDINGCAN](https://attack.mitre.org/software/S0520) is a remote access Trojan that has been used by the North Korean government since at least early 2020 in cyber operations against defense, engineering, and government organizations in Western Europe and the US.(Citation: US-CERT BLINDINGCAN Aug 2020)(Citation: NHS UK BLINDINGCAN Aug 2020)

Labels

malware

23 recorded

Relationships

uses

to Code Signing

Technique

uses

to Data from Local System

Technique

uses

to Deobfuscate/Decode Files or Information

Technique

uses

to Encrypted/Encoded File

Technique

uses

to Exfiltration Over C2 Channel

Technique

uses

to File and Directory Discovery

Technique

uses

to File Deletion

Technique

uses

to Ingress Tool Transfer

Technique

uses

to Local Storage Discovery

Technique

uses

to Malicious File

Technique

uses

to Match Legitimate Resource Name or Location

Technique

uses

Technique

uses

to Shared Modules

Technique

uses

to Software Packing

Technique

uses

to Spearphishing Attachment

Technique

uses

to Standard Encoding

Technique

uses

to Symmetric Cryptography

Technique

uses

to System Information Discovery

Technique

uses

to System Network Configuration Discovery

Technique

uses

Technique

uses

to Web Protocols

Technique

uses

to Windows Command Shell

Technique

uses

from Lazarus Group

Group

3 external

References

mitre-attack

S0520

NHS UK BLINDINGCAN Aug 2020

https://digital.nhs.uk/cyber-alerts/2020/cc-3603

US-CERT BLINDINGCAN Aug 2020

https://us-cert.cisa.gov/ncas/analysis-reports/ar20-232a