- Category
- State · Attributed to a state or working for one.
- Origin
- North Korea(high confidence)
- Sources
- 6 sources carry it
- Identifier
- GINC-APT-0331 · pearl-sleet
North KoreaWhat it is
Pearl Sleet is a nation state activity group based in North Korea that has been active since at least 2012. They primarily target defectors from North Korea, media organizations in carrying out their cyber espionage activities.
Names
The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.
- Microsoft
- DEV-0215
- Other names
- LAWRENCIUM
Attribution
Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.
Western sources
- MISP Galaxy (CFR tagging)North Korea
- MicrosoftNorth Korea
- ThreatActor.info (Malpedia et al.)North Korea
Tools
The tools and malware families the sources tie to it.
- Cyber Eye RAT
- CyberGate
Sources
- Malpedia malpedia.caad.fkie.fraunhofer.de