DHS, the FBI, and the Department of Defense attributed ECCENTRICBANDWAGON to the North Korean government activity set tracked as HIDDEN COBRA. The Windows malware performs reconnaissance by logging keystrokes and capturing screenshots, with closely related variants using different storage paths and, in some cases, RC4-encrypted strings. One variant attempts cleanup by deleting a control file and terminating Windows Explorer, potentially alerting the victim. CISA published hashes and a YARA rule to support detection and incident response.