StoatWaffle

aliases

Last seen:Mar 25, 2026

Intelligence Profile

Malware family tracked by Malpedia. ID: js.stoatwaffle

Threat Analysis

StoatWaffle is a known-sophistication threat actor of undetermined national origin, engaged in cyber operations with a primary motivation of unknown activity patterns.

Intelligence Reports Mentioning StoatWaffle

North Korean Hackers Abuse VS Code Auto-Run Tasks to Deploy StoatWaffle Malware

The Hacker News· Mar 23, 2026

External References

→https://jp.security.ntt/insights_resources/tech_blog/stoatwaffle_malware_en/

→https://redasgard.com/blog/hunting-lazarus-part2-blockchain-dead-drop

→https://www.jamf.com/blog/threat-actors-expand-abuse-of-visual-studio-code/

→https://www.microsoft.com/en-us/security/blog/2026/02/24/c2-developer-targeting-campaign/

→https://www.microsoft.com/en-us/security/blog/2026/03/11/contagious-interview-malware-delivered-through-fake-developer-job-interviews/

Quick Facts

TypeAPT / Threat Group

Aliases2

Also Known As

StoatWafflejs.stoatwaffle

External Intelligence

Malpedia: js.stoatwaffle

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search StoatWaffle