Torisma

MITRE ATT&CK: S0678 View on attack.mitre.org

Aliases: Torisma

First seen
2020-01-01 00:00:00
Malware type
spyware
Family
Malware family
Operating systems
windows
Profile updated
2026-07-07 12:46:55

Targeted industries: defense-and-aerospace

Targeted regions: country_code:us

Context

Torisma is a second stage implant designed for specialized monitoring that has been used by Lazarus Group. Torisma was discovered during an investigation into the 2020 Operation North Star campaign that targeted the defense sector.

Detection coverage

  • 2 YARA rules
  • 82 Sigma rules

Malware & tools used

  • Native API (attack-pattern)
  • Local Storage Discovery (attack-pattern)
  • System Time Discovery (attack-pattern)
  • Exfiltration Over C2 Channel (attack-pattern)
  • Standard Encoding (attack-pattern)
  • Execution Guardrails (attack-pattern)
  • System Network Connections Discovery (attack-pattern)
  • Deobfuscate/Decode Files or Information (attack-pattern)
  • Software Packing (attack-pattern)
  • Symmetric Cryptography (attack-pattern)
  • Web Protocols (attack-pattern)
  • System Network Configuration Discovery (attack-pattern)
  • Encrypted/Encoded File (attack-pattern)

Used by threat actors

  • Operation Dream Job (campaign)

Detection rules

  • DITEKSHEN_MALWARE_Win_Torisma (yara-rule)
  • MALPEDIA_Win_Torisma_Auto (yara-rule)

Reports & references

  • blogs.jpcert.or.jp — Lazarus Malware2 (report)
  • brandefense.io — Lazarus Apt Group Apt38 (report)
  • blog.nsfocus.net — Stumbzarus Apt Lazarus (report)
  • global.ahnlab.com — Asec%20Report Vol.102 Eng%20(4) (report)
  • telsy.com — Lazarus Gate (report)
  • McAfee — Operation North Star Behind The Scenes (report)
  • malpedia.caad.fkie.fraunhofer.de — Win.Torisma (report)
  • MITRE ATT&CK — S0678 (report)

External references