MISTPEN is a lightweight downloader used by Lazarus Group to communicate with C2 servers via Microsoft Graph API and OneDrive. It retrieves and executes reconnaissance and persistence modules, and triggers the AFD.sys exploit to escalate privileges.
MISTPEN is a lightweight downloader used by Lazarus Group to communicate with C2 servers via Microsoft Graph API and OneDrive. It retrieves and executes reconnaissance and persistence modules, and triggers the AFD.sys exploit to escalate privileges.