Lazarus Ottercookie Beavertai Indicators

nomit vyas@xoxo

•updated Feb 8, 2026•1•0•38

Detects TTPs associated with the Lazarus Group malware families OtterCookie and BeaverTail. This rule identifies persistence via registry run keys and scheduled tasks, suspicious node.js execution for keylogging, and network connections to known C2 infrastructure.