DHS, FBI, and DoD identified COPPERHEDGE as Manuscrypt-family remote-access malware used by the North Korean government and tracked under HIDDEN COBRA. The malware can execute arbitrary commands, perform system reconnaissance, exfiltrate data, and use proxy-supported command-and-control infrastructure to maintain access to victim networks. CISA documented six variants with shared code structures, encrypted HTTP communications, 22 submitted sample hashes, and 42 associated domains. The broader Manuscrypt family has been used in operations targeting cryptocurrency exchanges and related entities.