Gold Open Source
ExplorePackagesVulnerabilitiesCWEsMCP ServersScan
Login
Gold Open Source

The authoritative source for production-ready open-source components. Every package, container image, AI model, and MCP server undergoes rigorous verification for security, malware, and license compliance.

Explore Gold

  • Explore Everything
  • Packages
  • Gold Certified Packages
  • Container Images
  • AI Models
  • MCP Servers
  • Agent Skills
  • Chip Manufacturers

Security Data & Tools

  • Scan Your Dependencies
  • Trending Threats
  • Threat RSS Feeds
  • CVE Database
  • Actively Exploited (KEV)
  • SGZ Zero-Days
  • CWE Index
  • MITRE ATT&CK
  • Malicious Packages
  • Security Glossary
  • Supply-Chain Report
  • Developers (API & Badge)
  • Chrome Extension
  • Credits & Data Sources

Products

  • The Platform
  • ESSCM
  • Portal
  • TPRM
  • OSM
  • Cowork
  • Code / Runner
  • Guard

Use Cases

  • Know Your Software
  • Auto-Fix Vulnerabilities
  • Asset Discovery
  • AI Governance
  • MCP Server Security
  • Supply Chain Compliance
  • Zero-Day Discovery
  • All Use Cases

Company

  • About
  • Pricing
  • Blog
  • Documentation
  • Safeguard Academy
  • Contact
  • Privacy Policy
  • Terms of Service

© 2026 Gold Open Source. All rights reserved.

Built with care bySafeguard
Home/ATT&CK/Software/S0520
MITRE ATT&CK Malware

BLINDINGCAN (S0520)

ShareXLinkedInRedditHN

[BLINDINGCAN](https://attack.mitre.org/software/S0520) is a remote access Trojan that has been used by the North Korean government since at least early 2020 in cyber operations against defense, engineering, and government organizations in Western Europe and the US.(Citation: US-CERT BLINDINGCAN Aug 2020)(Citation: NHS UK BLINDINGCAN Aug 2020)

Platforms: Windows

▪Techniques implemented (22)

T1082System Information DiscoveryT1059.003Windows Command ShellT1071.001Web ProtocolsT1105Ingress Tool TransferT1005Data from Local SystemT1036.005Match Legitimate Resource Name or LocationT1132.001Standard EncodingT1027.013Encrypted/Encoded FileT1553.002Code SigningT1070.004File DeletionT1027.002Software PackingT1041Exfiltration Over C2 ChannelT1016System Network Configuration DiscoveryT1070.006TimestompT1129Shared ModulesT1204.002Malicious FileT1218.011Rundll32T1680Local Storage DiscoveryT1083File and Directory DiscoveryT1566.001Spearphishing AttachmentT1573.001Symmetric CryptographyT1140Deobfuscate/Decode Files or Information

▪Used by groups (1)

G0032Lazarus Group
S0520on MITRE ATT&CK →

MITRE ATT&CK® is a registered trademark of The MITRE Corporation. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.