KANDYKORN is a full-featured remote access trojan (RAT) capable of encrypted command and control (C2) communication, system enumeration, data exfiltration, terminating processes, and executing arbitrary system commands or payloads.

This malware was discovered as part of a much larger sophisticated attack where DPRK threat actors targeted blockchain engineers. The attackers deployed a multi-stage malware attack via a fake bot on Discord. The initial compromise involved various malicious Python scripts which downloaded additional malware components. Subsequently the python scripts would act as droppers for the next stage of the malware, which established a connection to a C2 server. An additional stage malware was used after this that employed persistence and defense evasion techniques like reflective binary loading which ultimate lead to the in-memory execution of the KandyKorn malware.