APT38
NICKEL GLADSTONEBeagleBoyzBluenoroffStardust ChollimaSapphire SleetCOPERNICIUM
UnattributedNo public state or group attribution on record
APT38 is a North Korean state-sponsored threat group that specializes in financial cyber operations; it has been attributed to the Reconnaissance General Bureau. Active since at least 2014, APT38 has targeted banks, financial institutions, casinos, cryptocurrency exchanges, SWIFT system endpoints, and ATMs in at least 38 countries worldwide.
MITRE ATT&CK Techniques
T1005T1027.002T1033T1036.003T1036.006T1049T1053.003T1053.005T1055T1056.001T1057T1059.001T1059.003T1059.005T1070.004T1070.006T1071.001T1082T1083T1105T1106T1110T1112T1115T1135T1140T1189T1204.001T1204.002T1217T1218.001T1218.005T1218.007T1218.011T1480.002T1485T1486T1505.003T1518.001T1529T1543.003T1548.002T1553.005T1561.002T1565.001T1565.002T1565.003T1566.001T1569.002T1583.001T1588.002T1685T1685.005T1686T1686.002T1690
Associated Malware
DarkCometECCENTRICBANDWAGONHOPLIGHTKillDiskMimikatzNet
No recent coverage in the current feed. This actor may be quiet, or reporting hasn't used a matched alias.