- Category
- State · Attributed to a state or working for one.
- Origin
- North Korea(medium confidence)contested
- Sponsor
- Unknown
- Motivation
- Espionage; Information theft and espionage
- Seen
- 2013
- Sources
- 7 sources carry it
- Identifier
- GINC-APT-0227 · oniondog
North KoreaWhat it is
This threat actor targets the South Korean government, transportation, and energy sectors.
Names
The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.
- Qihoo 360
- APT-C-03
Attribution
Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.
Western sources
- ETDA / ThaiCERTSouth Korea
- MISP Galaxy (CFR tagging)North Korea
- ThreatActor.info (Malpedia et al.)North Korea
Targets
- Countries
- South Korea
- Sectors
- Energy, Government, Private sector, Transportation, Utilities
Tools
The tools and malware families the sources tie to it.
- Malware on USB stick
Sources
- ETDA Threat Group Card apt.etda.or.th
- Malpedia malpedia.caad.fkie.fraunhofer.de