BankshotMalware
- COPPERHEDGE
- foggybrass
- trojan manuscript
Bankshot is a remote access tool (RAT) that was first reported by the Department of Homeland Security in December of 2017. In 2018, Lazarus Group used the Bankshot implant in attacks against the Turkish financial sector.From MITRE ATT&CK
Last reported 3 days ago, by Kaspersky Securelist2 reports
ATT&CK techniques
1 technique · each with the sentence it comes from- T1543.003Windows Service
“…echHub in the chain: an in‑memory version, a simple DLL side‑loading version, and a DLL side‑loading version that uses a registered Windows service.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
2 reports, newest first · the exact sentence from each-
Operation FlashHole: Lazarus breaks security, defies control“…round the time Operation SyncHole began winding down, we have also observed several notable attacks against South Korea employing the COPPERHEDGE backdoor and targeting various South Korean organizations.”
-
June 2026 CVE Landscape“…hark exploited public-facing applications to deploy SharkLoader and deliver Cobalt Strike; Lazarus exploited CVE-2025-55182 to deploy COPPERHEDGE; APT36 exploited Microsoft vulnerabilities in operations targeting India; a C0XMO botnet propagated through DD-WRT routers; EKZ inform…”
Thanks — we review every report.