Threadlinqs IntelligenceStart free

Threat actorNorth KoreaTracked since 2026-06

DPRK

Also known as:Rodrigo4

As of 2026-10-31, DPRK is a North Korea-nexus threat actor tracked by Threadlinqs Intelligence across 2 threats spanning malware. Also known as Rodrigo4. ATT&CK coverage spans 52 techniques across 12 tactics in 2 of 2 tracked threats. Most-observed techniques: T1036 (Masquerading), T1071.001 (Application Layer Protocol), T1539 (Steal Web Session Cookie).

Tracked threats
21 high · 1 medium
First seen
2026-06-23
Last seen
2026-10-31
ATT&CK techniques
52across 2 of 2 threats
Related CVEs
0None referenced
Attribution
North KoreaNation or origin
Nation: North Korea · 2 tracked threat(s) · Categories: MALWARE

Activity timeline

DPRK appears in 2 tracked threats between and ; the busiest month was 2026-06 with 1 report.

ATT&CK techniques observed

52 techniques observed across 2 of 2 tracked threats · Command and Control (9), Collection (7), Execution (7), Discovery (6), Credential Access (5), Exfiltration (5)
  • T1036 Masquerading — Stealth (formerly Defense Evasion)observed in 2 of 2 tracked threats
  • T1071.001 Application Layer Protocol — Command and Controlobserved in 2 of 2 tracked threats
  • T1539 Steal Web Session Cookie — Credential Accessobserved in 2 of 2 tracked threats
  • T1543.001 Create or Modify System Process: Launch Agent — Persistenceobserved in 2 of 2 tracked threats
  • T1555.001 Credentials from Password Stores: Keychain — Credential Accessobserved in 2 of 2 tracked threats
  • T1555.003 Credentials from Web Browsers — Credential Accessobserved in 2 of 2 tracked threats
  • AML.T0051.001 LLM Prompt Injection — Initial Accessobserved in 1 of 2 tracked threats
  • T1005 Data from Local System — Collectionobserved in 1 of 2 tracked threats
  • T1016.002 System Network Configuration Discovery: Wi-Fi Discovery — Discoveryobserved in 1 of 2 tracked threats
  • T1020 Automated Exfiltration — Exfiltrationobserved in 1 of 2 tracked threats
  • T1027 Obfuscated Files or Information — Stealth (formerly Defense Evasion)observed in 1 of 2 tracked threats
  • T1036.005 Match Legitimate Resource Name or Location — Stealth (formerly Defense Evasion)observed in 1 of 2 tracked threats
  • T1041 Exfiltration Over C2 Channel — Exfiltrationobserved in 1 of 2 tracked threats
  • T1048.003 Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 Protocol — Exfiltrationobserved in 1 of 2 tracked threats
  • T1057 Process Discovery — Discoveryobserved in 1 of 2 tracked threats

Tracked threats