DHS, FBI, and DoD identified VIVACIOUSGIFT as a Windows remote-access and network-proxy tool used by the North Korean government under the U.S. HIDDEN COBRA designation. The malware decrypts command-line configuration containing source, destination, and optional upstream-proxy settings, then receives commands to set its destination and relay encrypted traffic. CISA published six sample hashes, a YARA rule, and Snort signatures for the proxy protocol and encrypted command strings.