BLINDINGCAN
- ID
- S0520
- Type
- Malware
- Platforms
- Windows
- Source
- attack.mitre.org
- MITRE last modified
- 21 Oct 2025
BLINDINGCAN is a remote access Trojan that has been used by the North Korean government since at least early 2020 in cyber operations against defense, engineering, and government organizations in Western Europe and the US.[1][2]
Techniques used (22)
- T1005 Data from Local System
- T1016 System Network Configuration Discovery
- T1027.002 Software Packing
- T1027.013 Encrypted/Encoded File
- T1036.005 Match Legitimate Resource Name or Location
- T1041 Exfiltration Over C2 Channel
- T1059.003 Windows Command Shell
- T1070.004 File Deletion
- T1070.006 Timestomp
- T1071.001 Web Protocols
- T1082 System Information Discovery
- T1083 File and Directory Discovery
- T1105 Ingress Tool Transfer
- T1129 Shared Modules
- T1132.001 Standard Encoding
- T1140 Deobfuscate/Decode Files or Information
- T1204.002 Malicious File
- T1218.011 Rundll32
- T1553.002 Code Signing
- T1566.001 Spearphishing Attachment
- T1573.001 Symmetric Cryptography
- T1680 Local Storage Discovery