CISA attributes TAINTEDSCRIBE to the North Korean government activity it tracks as HIDDEN COBRA. The Windows implant masquerades as Microsoft Narrator, persists through the user's Startup folder, and connects to 211.192.239.232 over TCP port 8443 using a custom FakeTLS protocol with LFSR-encrypted traffic. It retrieves command modules that support file transfer and execution, command-line access, process control, and system enumeration. CISA published file hashes and detection signatures for the implant and its two EngineDll.dll modules.