Skip to content
MalwareWiki

Worm

WORMHOLE

WORMHOLE is a TCP tunneler that is dynamically configurable from a C&C server and can communicate with an additional remote machine endpoint for a relay.

WORMHOLE is a Windows worm operated by Lazarus Group.

Background

WORMHOLE is a TCP tunneling tool whose configuration can be adjusted on the fly from a C&C server, and it is able to talk to a further remote machine endpoint to act as a relay.

Source: Malpedia (Fraunhofer FKIE).