- Category
- State · Attributed to a state or working for one.
- Origin
- North Korea(high confidence)
- Sponsor
- Korea (Democratic People's Republic of)
- Agency named
- Lazarus, Reconnaissance General Bureau
- Motivation
- Espionage; Financial crime; Sabotage
- Seen
- 2014–2026
- Status
- Active
- ATT&CK
- G0082 · 115 techniques
- Sources
- 7 sources carry it
- Identifier
- GINC-APT-0172 · apt38
North KoreaWhat it is
APT38 is a North Korean state-sponsored threat group that specializes in financial cyber operations; it has been attributed to the Reconnaissance General Bureau. Active since at least 2014, APT38 has targeted banks, financial institutions, casinos, cryptocurrency exchanges, SWIFT system endpoints, and ATMs in at least 38 countries worldwide. Significant operations include the 2016 Bank of Bangladesh heist, Bancomext and Banco de Chile , along with software supply chain compromises and destructive malware attacks.
North Korean group definitions are known to have significant overlap, and some security researchers report all North Korean state-sponsored cyber activity under the name Lazarus Group instead of tracking clusters or subgroups.
Names
The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.
- CrowdStrike
- STARDUST CHOLLIMA, Bluenoroff, APT 38, Stardust Chollima, Labyrinth Chollima
- Mandiant
- TEMP.Hermit, APT 38
- Microsoft
- Citrine Sleet, DEV-0139, DEV-1222, Diamond Sleet, Moonstone Sleet, Sapphire Sleet
- MITRE ATT&CK
- G0082
- Proofpoint
- TA444, TA404
- Qihoo 360
- APT-C-26
- Recorded Future
- TAG-71
- Secureworks
- CTG-6459, NICKEL GLADSTONE
- Talos and others
- Group 77
- Thales
- ATK117, ATK3
- Operations
- Operation AppleJeus, Operation DarkSeoul, Operation GhostSecret, Operation Troy, Operation “FASTCash”
- Other names
- BeagleBoyz, Bluenoroff, FASTCash, Lazarus, Lazarus Group, Alluring Pisces, Andariel, Appleworm, ATK 117, Black Alicanto, Black Artemis, Bureau 121, COPERNICIUM, COVELLITE, Dark Seoul, Hastati Group, HERMIT NEPTUNE, Hidden Cobra, Lazarus - APT-C-26, NewRomanic Cyber Army Team, Nickel Academy, Selective Pisces, Subgroup: Bluenoroff, T-APT-15, Unit 121, Whois Hacking Team, ZINC
Attribution
Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.
Western sources
- ETDA / ThaiCERTNorth Korea
- MISP Galaxy (CFR tagging)North Korea
- ThreatActor.info (Malpedia et al.)North Korea
Chinese and Russian sources
- Qihoo 360North Korea
Targets
- Countries
- Argentina, Australia, Bangladesh, Bangladesh Bank, Bosnia and Herzegovina, Brazil, Bulgaria, Canada, Chile, China, Costa Rica, Cryptocurrency exchanges in South Korea, Ecuador, France, Germany, Ghana, Guatemala, Hong Kong, India, Indonesia, Japan, Jordan, Kenya, Kuwait, Malaysia, Malta, Mexico, Mozambique, Nepal, Nicaragua, Nigeria, Pakistan, Panama, Peru, Philippines, Singapore, Sony Pictures Entertainment, South Africa, South Korea, Spain, Taiwan, Tanzania, Thailand, Togo, Türkiye, Uganda, United Kingdom, United States, Uruguay, Vietnam, Zambia
- Sectors
- Financial, Government, Private sector
Tools
The tools and malware families the sources tie to it.
- Backdoor.Oldrea
- Cyber Eye RAT
- CyberGate
- DarkComet
- ECCENTRICBANDWAGON
- HOPLIGHT
- KillDisk
- Mimikatz
- Net
- Remote Utilities
- RemoteCMD
- RemotePC
- Xploit
Sources
- MITRE ATT&CK attack.mitre.org
- ETDA Threat Group Card apt.etda.or.th
- Malpedia malpedia.caad.fkie.fraunhofer.de
- Qihoo 360 apt.360.net