MeshAgent is the endpoint component of the legitimate MeshCentral remote-management platform, not malware by itself, but North Korean operators have installed or bundled it to preserve remote access. It can report system information and supports account and power control, file transfer, command execution, messaging, and browser-based remote desktop. Andariel abused Korean asset-management solutions to deploy it during lateral movement, while later Kimsuky-linked tooling downloaded encrypted MeshAgent files from Google Drive as a fallback if custom malware was quarantined.