Malware
COPPERHEDGE
- First Reported
- Jul 10, 2026
- Latest Reported
- Sep 3, 2026
Reported Context (2)
- Lazarus used Command and Scripting Interpreter to execute commands after exploiting React2Shell to deploy COPPERHEDGE against financial and blockchain-related organizations. Recorded Future Reports 215 Actively Exploited CVEs and Expanding Supply-Chain Threats in H1 2026
- to deploy SharkLoader and deliver Cobalt Strike; Lazarus exploited CVE-2025-55182 to deploy COPPERHEDGE; APT36 exploited Microsoft vulnerabilities in operations targeting India; a C0XMO botnet propagated Recorded Future Reported 59 High-Impact Vulnerabilities in June, 56 Actively Exploited
CVE (60)
Malware (53)
Threat Actors (18)
MITRE ATT&CK (13)
Vendors (44)
Products (105)
Tools (13)
Industries (10)
Countries (10)
Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.