- Category
- State · Attributed to a state or working for one.
- Origin
- North Korea(high confidence)
- Agency named
- Lazarus, Reconnaissance General Bureau
- Motivation
- Information theft and espionage
- Seen
- 2009–2026
- Status
- Active
- ATT&CK
- G0138 · 12 techniques
- Sources
- 7 sources carry it
- Identifier
- GINC-APT-0166 · andariel
North KoreaWhat it is
Andariel is a North Korean state-sponsored threat group that has been active since at least 2009. Andariel has primarily focused its operations--which have included destructive attacks--against South Korean government agencies, military organizations, and a variety of domestic companies; they have also conducted cyber financial operations against ATMs, banks, and cryptocurrency exchanges. Andariel's notable activity includes Operation Black Mine, Operation GoldenAxe, and Campaign Rifle.
Andariel is considered a sub-set of Lazarus Group, and has been attributed to North Korea's Reconnaissance General Bureau.
North Korean group definitions are known to have significant overlap, and some security researchers report all North Korean state-sponsored cyber activity under the name Lazarus Group instead of tracking clusters or subgroups.
Names
The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.
- CrowdStrike
- Silent Chollima, Andariel, Silent Chollima, Black Chollima
- Mandiant
- APT45, APT 45
- Microsoft
- Onyx Sleet
- MITRE ATT&CK
- G0138
- Operations
- Operation “BLACKMINE”, Operation “BLACKSHEEP”/Phase 3., Operation “Blacksmith”, Operation “DESERTWOLF”/Phase 3, Operation “GHOSTRAT”, Operation “GoldenAxe”, Operation “INITROY”/Phase 1, Operation “INITROY”/Phase 2, Operation “Mayday”, Operation “VANXATM”, Operation “XEDA”
- Other names
- DarkSeoul, GOP, GRASS NEPTUNE, Guardian of Peace, Jumpy Pisces, OperationTroy, PLUTONIUM, Stonefly, Subgroup: Andariel, Tdrop2 campaign, WHOis Team
Attribution
Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.
Western sources
- ETDA / ThaiCERTNorth Korea
- MISP Galaxy (CFR tagging)North Korea
- MicrosoftNorth Korea
- ThreatActor.info (Malpedia et al.)North Korea · high
Tools
The tools and malware families the sources tie to it.
- Cyber Eye RAT
- CyberGate
- Nuclear RAT
- Rifdoor
- gh0st RAT
Sources
- MITRE ATT&CK attack.mitre.org
- ETDA Threat Group Card apt.etda.or.th
- Malpedia malpedia.caad.fkie.fraunhofer.de