H3XA — Operational Evidence

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[HOPLIGHT](https://attack.mitre.org/software/S0376) is a backdoor Trojan that has reportedly been used by the North Korean government.(Citation: US-CERT HOPLIGHT Apr 2019)

Labels

malware

23 recorded

Relationships

uses

from APT38

Group

uses

to Device Driver Discovery

Technique

uses

to Disable or Modify System Firewall

Technique

uses

to Exfiltration Over C2 Channel

Technique

uses

to Fallback Channels

Technique

uses

to File and Directory Discovery

Technique

uses

to Ingress Tool Transfer

Technique

uses

to Local Storage Discovery

Technique

uses

to Modify Registry

Technique

uses

to Non-Standard Port

Technique

uses

to Pass the Hash

Technique

uses

to Process Injection

Technique

uses

to Proxy

Technique

uses

to Query Registry

Technique

uses

to Security Account Manager

Technique

uses

to Service Execution

Technique

uses

to Standard Encoding

Technique

uses

to System Information Discovery

Technique

uses

to System Time Discovery

Technique

uses

to Windows Command Shell

Technique

uses

to Windows Management Instrumentation

Technique

uses

to Windows Management Instrumentation Event Subscription

Technique

uses

from Lazarus Group

Group

3 external

References

mitre-attack

S0376

open

HOPLIGHT

—

US-CERT HOPLIGHT Apr 2019

https://www.us-cert.gov/ncas/analysis-reports/AR19-100A

open