# DPRK

> As of 2026-10-31, DPRK is a North Korea-nexus threat actor tracked by Threadlinqs Intelligence across 2 threats spanning malware. Also known as Rodrigo4. ATT&CK coverage spans 52 techniques across 12 tactics in 2 of 2 tracked threats. Most-observed techniques: T1036 (Masquerading), T1071.001 (Application Layer Protocol), T1539 (Steal Web Session Cookie).

- **Nation:** North Korea
- **Tracked threats:** 2
- **Categories:** MALWARE
- **Also known as:** Rodrigo4
- **As of:** 2026-10-31

## ATT&CK techniques observed

52 techniques observed across 2 of 2 tracked threats. Tactics: Command and Control (9), Collection (7), Execution (7), Discovery (6), Credential Access (5), Exfiltration (5).

- [T1036](https://intel.threadlinqs.com/technique/T1036) Masquerading — Stealth (formerly Defense Evasion) — observed in 2 of 2 tracked threats
- [T1071.001](https://intel.threadlinqs.com/technique/T1071.001) Application Layer Protocol — Command and Control — observed in 2 of 2 tracked threats
- [T1539](https://intel.threadlinqs.com/technique/T1539) Steal Web Session Cookie — Credential Access — observed in 2 of 2 tracked threats
- [T1543.001](https://intel.threadlinqs.com/technique/T1543.001) Create or Modify System Process: Launch Agent — Persistence — observed in 2 of 2 tracked threats
- [T1555.001](https://intel.threadlinqs.com/technique/T1555.001) Credentials from Password Stores: Keychain — Credential Access — observed in 2 of 2 tracked threats
- [T1555.003](https://intel.threadlinqs.com/technique/T1555.003) Credentials from Web Browsers — Credential Access — observed in 2 of 2 tracked threats
- [AML.T0051.001](https://intel.threadlinqs.com/technique/AML.T0051.001) LLM Prompt Injection — Initial Access — observed in 1 of 2 tracked threats
- [T1005](https://intel.threadlinqs.com/technique/T1005) Data from Local System — Collection — observed in 1 of 2 tracked threats
- [T1016.002](https://attack.mitre.org/techniques/T1016/002/) System Network Configuration Discovery: Wi-Fi Discovery — Discovery — observed in 1 of 2 tracked threats
- [T1020](https://intel.threadlinqs.com/technique/T1020) Automated Exfiltration — Exfiltration — observed in 1 of 2 tracked threats
- [T1027](https://intel.threadlinqs.com/technique/T1027) Obfuscated Files or Information — Stealth (formerly Defense Evasion) — observed in 1 of 2 tracked threats
- [T1036.005](https://intel.threadlinqs.com/technique/T1036.005) Match Legitimate Resource Name or Location — Stealth (formerly Defense Evasion) — observed in 1 of 2 tracked threats
- [T1041](https://intel.threadlinqs.com/technique/T1041) Exfiltration Over C2 Channel — Exfiltration — observed in 1 of 2 tracked threats
- [T1048.003](https://intel.threadlinqs.com/technique/T1048.003) Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 Protocol — Exfiltration — observed in 1 of 2 tracked threats
- [T1057](https://intel.threadlinqs.com/technique/T1057) Process Discovery — Discovery — observed in 1 of 2 tracked threats

## Tracked threats

- [The Mac Malware of 2024 - Objective-See annual review of macOS stealers, ransomware and backdoors (BeaverTail, SpectralBlur, LightSpy, NotLockBit)](https://intel.threadlinqs.com/threat/TL-2026-4887) — MEDIUM
- [macOS.Gaslight — DPRK-aligned Rust Backdoor & Infostealer with Analyst-Targeting Prompt-Injection Anti-Analysis (Telegram Bot API C2)](https://intel.threadlinqs.com/threat/TL-2026-0920) — HIGH

## Full data

Infrastructure, IOC values and detection queries (Splunk SPL / Microsoft KQL / Sigma) unlock per threat with TL Creds (https://threadlinqs.com/tl-creds); the Threadlinqs MCP server (Purple) serves them to AI agents: https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/actor/DPRK