Racket Downloader

aliases

Last seen:Mar 17, 2026

Intelligence Profile

Racket Downloader is an HTTP(S) downloader.

It uses a custom substitution cipher for decryption of its character strings, and RC5 with a 256-bit key for encryption and decryption of network traffic.

It sends an HTTP POST request containing a particular value that inspired its name, like "?product_field=racket" or "prd_fld=racket".

Racket Downloader was deployed against South Korean targets running the Initech INISAFE CrossWeb EX software in Q2 2021 and Q1 2022.

Threat Analysis

Racket Downloader is a known-sophistication threat actor of undetermined national origin, engaged in cyber operations with a primary motivation of unknown activity patterns.

External References

→https://asec.ahnlab.com/en/33801/

→https://asec.ahnlab.com/ko/40495/

→https://medium.com/s2wlab/analysis-of-lazarus-malware-abusing-non-activex-module-in-south-korea-7d52b9539c12

→https://securelist.com/the-lazarus-group-deathnote-campaign/109490/

→https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/lazarus-dream-job-chemical

Quick Facts

TypeAPT / Threat Group

Aliases2

Also Known As

win.racketRacket Downloader

External Intelligence

Malpedia: win.racket

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search Racket Downloader