SHARPKNOT is a Trojan used by the North Korean government and tracked by U.S. authorities within HIDDEN COBRA activity. The analyzed specimen was a malicious 32-bit Windows executable distributed in a joint Department of Homeland Security and Federal Bureau of Investigation malware analysis. SHARPKNOT is therefore established as a Windows malware family with North Korean state attribution, while its preserved technical record supports only a restrained family profile rather than a detailed account of its execution, persistence, collection, or communications behavior.