Lazarus_Group__2016__Operation-Blockbuster-Tools-Report.pdf
ID: a5f1aed9-ae88-490c-bf40-df89628d9d16
STIX ID: report--a5f1aed9-ae88-490c-bf40-df89628d9d16
Threat Score
90/100
Uploaded: 2026-08-15
Published Date: 2026-02-13
Last Modified Date: 2026-02-13
Created by: dogesec
TLP:CLEAR
ADMIRALTY:B2
PAP:CLEAR
...
...
Novetta's Operation Blockbuster reverse-engineering report analyzes a set of tools attributed to the Lazarus Group — KiloAlfa (keylogger), PapaAlfa (proxy/admin channel), TangoAlfa (network tester), TangoBravo (hosts redirector), TangoCharlie (firewall disabler), and TangoDelta (AV terminator) — describing their persistence mechanisms, communication protocols, artifacts (paths, registry keys, config files, log formats), and operational roles in enabling espionage, staging, and evasive operations.