https_nkinternet.com_wp-content_uploads_2026_08_malheur_prototype_samples.csv (5 KB)

A newly surfaced version of North Korea’s SiliVaccine antivirus replaces the stolen Trend Micro engine found in 2018 with ClamAV signatures and Malheur-based behavioral clustering. Internal artifacts still point to suspected developer PGI, while the user-facing product is now named Cheongryubyeok and uses KVACCINE, BlueStream, and CVaccine as component or project names. Its interface provides memory, system-area, custom, and scheduled scanning alongside firewall, intrusion-detection, USB-scanning, and update controls. The Malheur training set is largely generic W32/Virux material rather than a curated collection of DPRK malware.