YamaBot

aliases

Last seen:Mar 17, 2026

Intelligence Profile

Malware family tracked by Malpedia. ID: win.yamabot

Threat Analysis

YamaBot is a known-sophistication threat actor of undetermined national origin, engaged in cyber operations with a primary motivation of unknown activity patterns.

External References

→https://blog.talosintelligence.com/2022/09/lazarus-three-rats.html

→https://blog.talosintelligence.com/2022/09/lazarus-three-rats.html?m=1

→https://blogs.jpcert.or.jp/en/2022/07/yamabot.html

→https://media.defense.gov/2023/Feb/09/2003159161/-1/-1/0/CSA_RANSOMWARE_ATTACKS_ON_CI_FUND_DPRK_ACTIVITIES.PDF

→https://www.youtube.com/watch?v=nUjxH1gW53s

Quick Facts

TypeAPT / Threat Group

Aliases3

Also Known As

KaosYamaBotwin.yamabot

External Intelligence

Malpedia: win.yamabot

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search YamaBot