ECCENTRICBANDWAGON is a Windows reconnaissance tool used by North Korean actors and tracked in U.S. government reporting as HIDDEN COBRA. It records keystrokes and captures screenshots, staging the results in temporary directories that mimic Google Chrome, Downloads, or Trend Micro update paths. CISA analyzed both 32-bit and 64-bit DLL variants. Some variants encrypt embedded strings with RC4, while another monitors a temporary file as an exit signal, deletes it, and terminates Windows Explorer during cleanup. The samples were identified as PSLogger DLLs and support information gathering and continued exploitation on compromised systems. MITRE ATT&CK S0593.