North Korea Reuses Open-Source Code for Antivirus Software

North Korea has rebuilt its antivirus software using ClamAV, an open-source engine maintained by Cisco Talos. The country has recompiled and repurposed ClamAV's code to create four different domestic product names, underscoring Pyongyang's reliance on foreign code to secure tightly controlled networks.

The use of ClamAV's GPL-licensed code allows North Korean developers to lift a mature detection engine, signature format, and update mechanism without needing to build an AV stack from scratch. This is consistent with earlier technical analyses of SiliVaccine, which found extensive borrowing from third-party antivirus engines and foreign development practices within North Korea's security software.

The four different product names - ModernStealer, Dark Web Tracker, Stealthmole, and Update routines - are marketed as independent security products, but static and behavioral analysis points to a single lineage. The engines preserve ClamAV's signature taxonomy, including category and platform naming schemes, and follow recognizable patterns for malware families and CVE-style identifiers.

Stealthmole researchers noted that rebuilding ClamAV offers North Korea three advantages: rapid access to a functional malware detection stack, lower development cost, and the ability to present indigenous security tools to politically sensitive customers. However, this reuse raises familiar concerns among defenders outside the country, as it creates potential for dual-use and bypassing of ClamAV-like defenses elsewhere.