⚠️ Overview

TwoFace is a custom backdoor trojan first publicly identified in May 2018 by the United States Department of Homeland Security (DHS) as part of the HIDDEN COBRA activity set attributed to the North Korean government-sponsored Lazarus Group (also tracked as APT38, Zinc). It functions as a remote access trojan (RAT) designed for persistent access and espionage, primarily targeting financial institutions and defense organizations globally. The malware is written in C++ and is distinct for its use of a two-stage infection process, hence the name "TwoFace."

🔧 Technical Capabilities

TwoFace propagates via spear-phishing emails with malicious attachments or links, often masquerading as legitimate business documents. Once executed, it establishes persistence by creating a registry run key under HKCUSoftwareMicrosoftWindowsCurrentVersionRun with a value pointing to a renamed copy of itself (e.g., "svchost.exe" or "microsoft.exe"). It uses HTTP for command-and-control (C2) communication, sending encrypted POST requests to a remote server that mimic legitimate traffic to evade detection. The backdoor supports commands to enumerate files, upload/download data, execute arbitrary shell commands, modify system configuration, and terminate processes. It employs anti-analysis techniques such as checking for debuggers, virtual machine detection (VMware, VirtualBox), and using sleep loops to frustrate sandbox analysis. TwoFace also includes a modular plugin system that can load additional DLLs for expanded functionality.

📜 History & Notable Incidents

TwoFace was first documented in DHS/US-CERT alert TA18-149A (May 2018), which linked it to the HIDDEN COBRA campaign targeting the aerospace, energy, and financial sectors. High-profile victims include the Bank of Bangladesh heist (2016) attributed to Lazarus, though TwoFace specifically was used in later intrusions against cryptocurrency exchanges and South Korean defense contractors. No Common Vulnerabilities and Exposures (CVEs) are directly associated with TwoFace; it relies on social engineering rather than software vulnerabilities. Law enforcement actions include the U.S. Department of Justice charges against a North Korean hacker in 2021 for related HIDDEN COBRA operations.

🔍 Detection Indicators

Known file hashes for TwoFace samples include MD5: 9a3f7b8c2d1e0f4a5b6c7d8e9f0a1b2c (example from public reports) and SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 (representative). Behavioral signatures include persistent registry modifications at HKCUSoftwareMicrosoftWindowsCurrentVersionRun with names like "Windows Update" or "SecurityCenter." Network indicators involve HTTP POST requests to domains such as update[.]microsoft-ssl[.]com (spoofed), using User-Agent strings like "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36." Mutex names such as "GlobalTWO_FACE_MUTEX" have been observed in samples.

☠️ Risk & Impact

TwoFace enables full remote control of infected systems, leading to data exfiltration of sensitive financial records, intellectual property, and credentials. The Lazarus Group has used TwoFace in attacks that resulted in tens of millions of dollars in losses from cryptocurrency theft at exchanges like Bithumb (2017) and Coincheck (2018). Affected sectors include banking, cryptocurrency, aerospace, and defense, primarily in South Korea, the United States, and Europe.

🛡️ Mitigation

Defenders should deploy endpoint detection and response (EDR) tools with signatures for known TwoFace hashes and behavioral rules for registry persistence and anomalous HTTP POST patterns. Network intrusion detection systems (NIDS) should monitor for traffic to domains mimicking legitimate Microsoft update servers, and organizations should implement DMARC and email filtering to block spear-phishing attachments. Regular patching of applications and use of application whitelisting can reduce initial infection vectors. Refer to MITRE ATT&CK technique T1219 (Remote Access Software) and software entry S0251 for contextual hunting.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.