Atharvan

Atharvan is a custom remote access trojan/backdoor associated with the North Korea-linked threat group Andariel, which is assessed as operating under the DPRK Reconnaissance General Bureau (RGB) 3rd Bureau and widely tracked as a Lazarus sub-cluster. In the provided reporting, Atharvan is specifically described as an "Atharvan ELF Backdoor" and as a custom RAT that creates the mutex "SAPTARISHI-ATHARVAN-101" and disguises command-and-control traffic as legitimate Microsoft update traffic. Atharvan is listed among Andariel-developed RATs and implants used to permit remote access, manipulation of compromised systems, and lateral movement. The broader advisory context attributes Andariel activity to intrusions targeting defense, aerospace, nuclear, engineering, medical, and energy organizations, with collection priorities tied to military and nuclear programs and with ransomware activity also observed in parallel. Initial access in those operations commonly involved exploitation of public-facing applications and known vulnerabilities, deployment of web shells, phishing with ZIP archives containing LNK or HTA files, credential theft, and lateral movement using built-in tools and remote access protocols. High-confidence malware-specific indicators directly mentioned in the content are the mutex "SAPTARISHI-ATHARVAN-101" and the use of C2 traffic disguised as Microsoft update traffic.