Netskope Threat Labs

Joanap

ATP Sandbox Adv. Heuristics

Joanap is a backdoor used by the North Korean Hidden Cobra actors alongside the Brambul worm, providing remote control of compromised systems, and US authorities published detailed indicators for the family in public alerts.

First seen
April 2022
Last seen
September 2026
Alert Name
Win32.Backdoor.Joanap