LiveActive security incident?Get immediate response
MITRE ATT&CK® Group

G0082: APT38

APT38 is a North Korean state-sponsored threat group that specializes in financial cyber operations; it has been attributed to the Reconnaissance General Bureau.[1] Active since at least 2014, APT38 has targeted banks, financial institutions, casinos, cryptocurrency exchanges, SWIFT system endpoints, and ATMs in at least 38 countries worldwide. Significant operations include the 2016 Bank of Bangladesh heist, during which APT38 stole $81 million, as well as attacks against Bancomext [2] and Banco de Chile [2]; some of their attacks have been destructive.[1][2][3][4]

North Korean group definitions are known to have significant overlap, and some security researchers report all North Korean state-sponsored cyber activity under the name Lazarus Group instead of tracking clusters or subgroups.

EnterpriseG0082GroupObject v3.1Modified
Discuss defensive coverageBack to ATT&CK
Glexia's Take · Automated analysis

Security context for executives and security teams

Automation confidenceHigh

APT38 matters because ATT&CK describes it as a North Korean state-sponsored group focused on financial cyber operations, with reported targeting of banks, financial institutions, casinos, cryptocurrency exchanges, SWIFT endpoints, and ATMs across many countries. For leaders, the business issue is not only theft risk; the official description also notes destructive attacks, making resilience, transaction integrity, credential protection, and recovery readiness central concerns.

Executive priority

Prioritize APT38-relevant readiness where financial transaction systems, payment infrastructure, cryptocurrency operations, ATM/SWIFT-connected environments, or high-value financial workflows exist. Executives should ask whether the organization can prove control coverage for credential theft, remote access tooling, discovery, persistence, command execution, web-based command-and-control, local data collection, and destructive wiping scenarios. This object is also useful for audit and board discussions because it links financial crime risk to concrete ATT&CK behaviors and recovery requirements.

Technical view

MITRE provides no standalone detection text for APT38, so SOC and IR teams should validate coverage through the related software and techniques. Relationship context includes Windows-focused tooling such as Mimikatz, Net, DarkComet, HOPLIGHT, ECCENTRICBANDWAGON, PowerShell, Windows Command Shell, Scheduled Task, and Windows credential/collection behaviors, plus cross-platform behaviors such as process injection, file deletion, timestomping, web protocol C2, local data collection, and KillDisk on Windows/Linux. Detection engineering should map alerts and hunts to the behaviors rather than relying on the group name or aliases alone.

Likely telemetry

  • Endpoint process creation and command-line telemetry for PowerShell, cmd, Net, scheduled tasks, renamed utilities, and suspicious script execution
  • Windows security, authentication, credential access, and LSASS/credential-dumping relevant events where collected
  • EDR telemetry for process injection, packed executables, remote access tools, keylogging indicators, and suspicious parent-child process chains
  • File system telemetry for file deletion, timestomping, unusual executable names, local data staging, and disk-wiping indicators
  • Network telemetry for HTTP/HTTPS or other web-protocol command-and-control patterns, unusual external destinations, and suspicious beaconing

Detection direction

  • Do not build coverage around the name APT38 alone; tune around the related ATT&CK behaviors and known aliases such as BeagleBoyz, Bluenoroff, Stardust Chollima, Sapphire Sleet, COPERNICIUM, and NICKEL GLADSTONE for intelligence correlation.
  • Validate whether credential dumping, keylogging, remote access Trojan behavior, and discovery activity can be detected before transaction manipulation or destructive actions occur.
  • Tune command-line analytics for administrative tools such as Net, PowerShell, cmd, scheduled tasks, and cron with context to reduce false positives from legitimate administration.
  • Hunt for stealth patterns including packed binaries, process injection, renamed legitimate utilities, file deletion, and timestomping; these may be missed by signature-only controls.
  • Review network detections for web-protocol C2 that blends into normal HTTP/S traffic, with allowlist and business-context tuning to manage false positives.

Mitigation priorities

  • Start with identity and privilege controls: reduce standing privileged access, harden administrative paths to financial systems, and monitor credential access attempts.
  • Harden and monitor endpoints that support payment, SWIFT, ATM, cryptocurrency, and financial operations, especially Windows systems reflected in several related tools and techniques.
  • Restrict and log administrative scripting and scheduling mechanisms such as PowerShell, cmd, scheduled tasks, cron, and Net usage according to business need.
  • Improve segmentation and monitoring around financial transaction infrastructure so discovery, lateral movement preparation, and remote access activity have fewer paths to critical systems.
  • Maintain tested offline or otherwise resilient backups and recovery procedures for systems where destructive wiping would affect business continuity.
Additional notes and limits

The official ATT&CK entry identifies APT38 as a North Korean state-sponsored group attributed to the Reconnaissance General Bureau and focused on financial cyber operations. It also notes overlap in North Korean group naming, with some researchers reporting related activity under Lazarus Group instead of separate clusters or subgroups. That naming ambiguity makes behavior-based detection and intelligence normalization important.

ATT&CK does not provide detection text, explicit tactics, or platforms for the APT38 intrusion-set object itself. Platform and tactic guidance here is derived only from supplied relationship context to software and techniques. Local relevance depends on whether the organization operates financial transaction systems, SWIFT/ATM infrastructure, cryptocurrency platforms, or similar high-value financial environments.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

APT38

APT38 is a North Korean state-sponsored threat group that specializes in financial cyber operations; it has been attributed to the Reconnaissance General Bureau.[1] Active since at least 2014, APT38 has targeted banks, financial institutions, casinos, cryptocurrency exchanges, SWIFT system endpoints, and ATMs in at least 38 countries worldwide. Significant operations include the 2016 Bank of Bangladesh heist, during which APT38 stole $81 million, as well as attacks against Bancomext [2] and Banco de Chile [2]; some of their attacks have been destructive.[1][2][3][4]

North Korean group definitions are known to have significant overlap, and some security researchers report all North Korean state-sponsored cyber activity under the name Lazarus Group instead of tracking clusters or subgroups.

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

56 rows
DomainIDNameRelationship / procedure
EnterpriseT1486Data Encrypted for Impact

APT38 has used Hermes ransomware to encrypt files with AES256.[2]

EnterpriseT1055Process Injection

APT38 has injected malicious payloads into the `explorer.exe` process.[5]

EnterpriseT1033System Owner/User Discovery

APT38 has identified primary users, currently logged in users, sets of users that commonly use a system, or inactive users.[1]

EnterpriseT1112Modify Registry

APT38 uses a tool called CLEANTOAD that has the capability to modify Registry keys.[2]

EnterpriseT1049System Network Connections Discovery

APT38 installed a port monitoring tool, MAPMAKER, to print the active TCP connections on the local system.[2]

EnterpriseT1070.004File DeletionSub-technique

APT38 has used a utility called CLOSESHAVE that can securely delete a file from the system. They have also removed malware, tools, or other non-native files used during the intrusion to reduce their footprint or as part of the post-intrusion cleanup process.[2][1]

EnterpriseT1036.006Space after FilenameSub-technique

APT38 has put several spaces before a file extension to avoid detection and suspicion.[5]

EnterpriseT1056.001KeyloggingSub-technique

APT38 used a Trojan called KEYLIME to capture keystrokes from the victim’s machine.[2]

EnterpriseT1518.001Security Software DiscoverySub-technique

APT38 has identified security software, configurations, defensive tools, and sensors installed on a compromised system.[1][5]

EnterpriseT1543.003Windows ServiceSub-technique

APT38 has installed a new Windows service to establish persistence.[1]

EnterpriseT1548.002Bypass User Account ControlSub-technique

APT38 has used the legitimate application `ieinstal.exe` to bypass UAC.[5]

EnterpriseT1189Drive-by Compromise

APT38 has conducted watering holes schemes to gain initial access to victims.[2][1]

EnterpriseT1083File and Directory Discovery

APT38 have enumerated files and directories, or searched in specific locations within a compromised host.[1]

EnterpriseT1059.003Windows Command ShellSub-technique

APT38 has used a command-line tunneler, NACHOCHEESE, to give them shell access to a victim’s machine.[2] Additionally, APT38 has used batch scripts.[5]

EnterpriseT1140Deobfuscate/Decode Files or Information

APT38 has used the RC4 algorithm to decrypt configuration data. [5]

EnterpriseT1059.005Visual BasicSub-technique

APT38 has used VBScript to execute commands and other operational tasks.[1][5]

EnterpriseT1529System Shutdown/Reboot

APT38 has used a custom MBR wiper named BOOTWRECK, which will initiate a system reboot after wiping the victim's MBR.[2]

EnterpriseT1204.001Malicious LinkSub-technique

APT38 has used links to execute a malicious Visual Basic script.[5]

EnterpriseT1071.001Web ProtocolsSub-technique

APT38 used a backdoor, QUICKRIDE, to communicate to the C2 server over HTTP and HTTPS.[2]

EnterpriseT1105Ingress Tool Transfer

APT38 used a backdoor, NESTEGG, that has the capability to download and upload files to and from a victim’s machine.[2] Additionally, APT38 has downloaded other payloads onto a victim’s machine.[5]

EnterpriseT1685Disable or Modify Tools

APT38 has unhooked DLLs to disable endpoint detection and response (EDR) or anti-virus (AV) tools.[5]

EnterpriseT1027.002Software PackingSub-technique

APT38 has used several code packing methods such as Themida, Enigma, VMProtect, and Obsidium, to pack their implants.[2]

EnterpriseT1217Browser Information Discovery

APT38 has collected browser bookmark information to learn more about compromised hosts, obtain personal information about users, and acquire details about internal network resources.[1]

EnterpriseT1685.005Clear Windows Event LogsSub-technique

APT38 clears Window Event logs and Sysmon logs from the system.[2]

EnterpriseT1218.005MshtaSub-technique

APT38 has used a renamed version of `mshta.exe` to execute malicious HTML files.[5]

EnterpriseT1070.006TimestompSub-technique

APT38 has modified data timestamps to mimic files that are in the same folder on a compromised host.[1]

EnterpriseT1686Disable or Modify System Firewall

APT38 have created firewall exemptions on specific ports, including ports 443, 6443, 8443, and 9443.[1]

EnterpriseT1485Data Destruction

APT38 has used a custom secure delete function to make deleted files unrecoverable.[2]

EnterpriseT1110Brute Force

APT38 has used brute force techniques to attempt account access when passwords are unknown or when password hashes are unavailable.[1]

EnterpriseT1135Network Share Discovery

APT38 has enumerated network shares on a compromised host.[1]

EnterpriseT1553.005Mark-of-the-Web BypassSub-technique

APT38 has used ISO and VHD files to deploy malware and to bypass Mark-of-the-Web (MOTW) security measures.[5]

EnterpriseT1082System Information Discovery

APT38 has attempted to get detailed information about a compromised host, including the operating system, version, patches, hotfixes, and service packs.[1]

EnterpriseT1565.002Transmitted Data ManipulationSub-technique

APT38 has used DYEPACK to manipulate SWIFT messages en route to a printer.[2]

EnterpriseT1686.002Network Device FirewallSub-technique

APT38 have created firewall exemptions on specific ports, including ports 443, 6443, 8443, and 9443. [1]

EnterpriseT1561.002Disk Structure WipeSub-technique

APT38 has used a custom MBR wiper named BOOTWRECK to render systems inoperable.[2]

EnterpriseT1036.003Rename Legitimate UtilitiesSub-technique

APT38 has renamed system utilities, such as `rundll32.exe` and `mshta.exe`, to avoid detection.[5]

EnterpriseT1690Prevent Command History Logging

APT38 has prepended a space to all of their terminal commands to operate without leaving traces in the HISTCONTROL environment.[1]

EnterpriseT1053.005Scheduled TaskSub-technique

APT38 has used Task Scheduler to run programs at system startup or on a scheduled basis for persistence.[1] Additionally, APT38 has used living-off-the-land scripts to execute a malicious script via a scheduled task.[5]

EnterpriseT1588.002ToolSub-technique

APT38 has obtained and used open-source tools such as Mimikatz.[6]

EnterpriseT1505.003Web ShellSub-technique

APT38 has used web shells for persistence or to ensure redundant access.[1]

EnterpriseT1115Clipboard Data

APT38 used a Trojan called KEYLIME to collect data from the clipboard.[2]

EnterpriseT1218.011Rundll32Sub-technique

APT38 has used rundll32.exe to execute binaries, scripts, and Control Panel Item files and to execute code via proxy to avoid triggering security tools.[1][5]

EnterpriseT1565.003Runtime Data ManipulationSub-technique

APT38 has used DYEPACK.FOX to manipulate PDF data as it is accessed to remove traces of fraudulent SWIFT transactions from the data displayed to the end user.[2]

EnterpriseT1583.001DomainsSub-technique

APT38 has created fake domains to imitate legitimate venture capital or bank domains.[5]

EnterpriseT1106Native API

APT38 has used the Windows API to execute code within a victim's system.[1]

EnterpriseT1218.001Compiled HTML FileSub-technique

APT38 has used CHM files to move concealed payloads.[7]

EnterpriseT1204.002Malicious FileSub-technique

APT38 has attempted to lure victims into enabling malicious macros within email attachments.[1] Additionally, APT38 has used malicious Word documents and shortcut files.[5]

EnterpriseT1565.001Stored Data ManipulationSub-technique

APT38 has used DYEPACK to create, delete, and alter records in databases used for SWIFT transactions.[2]

EnterpriseT1005Data from Local System

APT38 has collected data from a compromised host.[1]

EnterpriseT1059.001PowerShellSub-technique

APT38 has used PowerShell to execute commands and other operational tasks.[1]

EnterpriseT1053.003CronSub-technique

APT38 has used cron to create pre-scheduled and periodic background jobs on a Linux system.[1]

EnterpriseT1566.001Spearphishing AttachmentSub-technique

APT38 has conducted spearphishing campaigns using malicious email attachments.[1]

EnterpriseT1218.007MsiexecSub-technique

APT38 has used `msiexec.exe` to execute malicious files.[5]

EnterpriseT1569.002Service ExecutionSub-technique

APT38 has created new services or modified existing ones to run executables, commands, or scripts.[1]

EnterpriseT1480.002Mutual ExclusionSub-technique

APT38 has created a mutex to avoid duplicate execution.[5]

EnterpriseT1057Process Discovery

APT38 leveraged Sysmon to understand the processes, services in the organization.[2]

Associated objects

Groups, software, and campaigns

MalwareEnterprise

S0593: ECCENTRICBANDWAGON

ECCENTRICBANDWAGON is a remote access Trojan (RAT) used by North Korean cyber actors that was first identified in August 2020. It is a reconnaissance tool--with keylogging and screen capture functionality--used for information gathering on compromised systems.[1]

Windows
ToolEnterprise

S0039: Net

The Net utility is a component of the Windows operating system. It is used in command-line operations for control of users, groups, services, and network connections. [1]

Net has a great deal of functionality, [2] much of which is useful for an adversary, such as gathering system and network information for Discovery, moving laterally through SMB/Windows Admin Shares using net use commands, and interacting with services. The net1.exe utility is executed for certain functionality when net.exe is run and can be used directly in commands such as net1 user.

Windows
ToolEnterprise

S0002: Mimikatz

Mimikatz is a credential dumper capable of obtaining plaintext Windows account logins and passwords, along with many other features that make it useful for testing the security of networks. [1] [2]

Windows
MalwareEnterprise

S0607: KillDisk

KillDisk is a disk-wiping tool designed to overwrite files with random data to render the OS unbootable. It was first observed as a component of BlackEnergy malware during cyber attacks against Ukraine in 2015. KillDisk has since evolved into stand-alone malware used by a variety of threat actors against additional targets in Europe and Latin America; in 2016 a ransomware component was also incorporated into some KillDisk variants.[1][2][3][4]

LinuxWindows
Relationship explorer

All related ATT&CK context

uses · TechniqueT1486: Data Encrypted for ImpactEnterpriseuses · TechniqueT1055: Process InjectionEnterpriseuses · TechniqueT1033: System Owner/User DiscoveryEnterpriseuses · TechniqueT1112: Modify RegistryEnterpriseuses · MalwareS0593: ECCENTRICBANDWAGONEnterpriseuses · TechniqueT1049: System Network Connections DiscoveryEnterpriseuses · TechniqueT1070.004: File DeletionEnterpriseuses · TechniqueT1036.006: Space after FilenameEnterpriseuses · TechniqueT1056.001: KeyloggingEnterpriseuses · TechniqueT1518.001: Security Software DiscoveryEnterpriseuses · ToolS0039: NetEnterpriseuses · TechniqueT1543.003: Windows ServiceEnterpriseuses · TechniqueT1548.002: Bypass User Account ControlEnterpriseuses · TechniqueT1189: Drive-by CompromiseEnterpriseuses · TechniqueT1083: File and Directory DiscoveryEnterpriseuses · TechniqueT1059.003: Windows Command ShellEnterpriseuses · TechniqueT1140: Deobfuscate/Decode Files or InformationEnterpriseuses · MalwareS0376: HOPLIGHTEnterpriseuses · TechniqueT1059.005: Visual BasicEnterpriseuses · TechniqueT1529: System Shutdown/RebootEnterpriseuses · TechniqueT1204.001: Malicious LinkEnterpriseuses · TechniqueT1071.001: Web ProtocolsEnterpriseuses · TechniqueT1105: Ingress Tool TransferEnterpriseuses · TechniqueT1685: Disable or Modify ToolsEnterprise
Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release
19.1
Object version
3.1
Created
Modified
Raw hash
093f161abc03699b...
Imported snapshots across ATT&CK releases(1)
ReleaseBundle importedObject versionModifiedStatusRaw hash
19.13.1Current bundle093f161abc03…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSONOpen MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    CISA AA20-239A BeagleBoyz August 2020

    DHS/CISA. (2020, August 26). FASTCash 2.0: North Korea's BeagleBoyz Robbing Banks. Retrieved September 29, 2021.

    Open source URL
  2. [2]
    FireEye APT38 Oct 2018

    FireEye. (2018, October 03). APT38: Un-usual Suspects. Retrieved November 17, 2024.

    Open source URL
  3. [3]
    DOJ North Korea Indictment Feb 2021

    Department of Justice. (2021, February 17). Three North Korean Military Hackers Indicted in Wide-Ranging Scheme to Commit Cyberattacks and Financial Crimes Across the Globe. Retrieved June 9, 2021.

    Open source URL
  4. [4]
    Kaspersky Lazarus Under The Hood Blog 2017

    GReAT. (2017, April 3). Lazarus Under the Hood. Retrieved April 17, 2019.

    Open source URL
  5. [5]
    1 - appv

    SEONGSU PARK. (2022, December 27). BlueNoroff introduces new methods bypassing MoTW. Retrieved February 6, 2024.

    Open source URL
  6. [6]
    ESET Lazarus KillDisk April 2018

    Kálnai, P., Cherepanov A. (2018, April 03). Lazarus KillDisks Central American casino. Retrieved May 17, 2018.

    Open source URL
  7. [7]
    Kaspersky Lazarus Under The Hood APR 2017

    GReAT. (2017, April 3). Lazarus Under the Hood. Retrieved October 3, 2018.

    Open source URL
  8. [8]
    APT38

    (Citation: FireEye APT38 Oct 2018)

  9. [9]
    APT38

    (Citation: FireEye APT38 Oct 2018)

  10. [10]
    APT38

    (Citation: FireEye APT38 Oct 2018)

  11. [11]
    BeagleBoyz

    (Citation: CISA AA20-239A BeagleBoyz August 2020)

  12. [12]
    BeagleBoyz

    (Citation: CISA AA20-239A BeagleBoyz August 2020)

  13. [13]
    BeagleBoyz

    (Citation: CISA AA20-239A BeagleBoyz August 2020)

  14. [14]
    Bluenoroff

    (Citation: Kaspersky Lazarus Under The Hood Blog 2017)

  15. [15]
    Bluenoroff

    (Citation: Kaspersky Lazarus Under The Hood Blog 2017)

  16. [16]
    Bluenoroff

    (Citation: Kaspersky Lazarus Under The Hood Blog 2017)

  17. [17]
    CISA AA20-239A BeagleBoyz August 2020

    DHS/CISA. (2020, August 26). FASTCash 2.0: North Korea's BeagleBoyz Robbing Banks. Retrieved September 29, 2021.

    Open source URL
  18. [18]
    CISA AA20-239A BeagleBoyz August 2020

    DHS/CISA. (2020, August 26). FASTCash 2.0: North Korea's BeagleBoyz Robbing Banks. Retrieved September 29, 2021.

    Open source URL
  19. [19]
    COPERNICIUM

    (Citation: Microsoft Threat Actor Naming July 2023)

  20. [20]
    COPERNICIUM

    (Citation: Microsoft Threat Actor Naming July 2023)

  21. [21]
    COPERNICIUM

    (Citation: Microsoft Threat Actor Naming July 2023)

  22. [22]
    CrowdStrike GTR 2021 June 2021

    CrowdStrike. (2021, June 7). CrowdStrike 2021 Global Threat Report. Retrieved September 29, 2021.

    Open source URL
  23. [23]
    CrowdStrike GTR 2021 June 2021

    CrowdStrike. (2021, June 7). CrowdStrike 2021 Global Threat Report. Retrieved September 29, 2021.

    Open source URL
  24. [24]
    CrowdStrike GTR 2021 June 2021

    CrowdStrike. (2021, June 7). CrowdStrike 2021 Global Threat Report. Retrieved September 29, 2021.

    Open source URL
  25. [25]
    CrowdStrike Stardust Chollima Profile April 2018

    Meyers, Adam. (2018, April 6). Meet CrowdStrike’s Adversary of the Month for April: STARDUST CHOLLIMA. Retrieved September 29, 2021.

    Open source URL
  26. [26]
    CrowdStrike Stardust Chollima Profile April 2018

    Meyers, Adam. (2018, April 6). Meet CrowdStrike’s Adversary of the Month for April: STARDUST CHOLLIMA. Retrieved September 29, 2021.

    Open source URL
  27. [27]
    CrowdStrike Stardust Chollima Profile April 2018

    Meyers, Adam. (2018, April 6). Meet CrowdStrike’s Adversary of the Month for April: STARDUST CHOLLIMA. Retrieved September 29, 2021.

    Open source URL
  28. [28]
    DOJ North Korea Indictment Feb 2021

    Department of Justice. (2021, February 17). Three North Korean Military Hackers Indicted in Wide-Ranging Scheme to Commit Cyberattacks and Financial Crimes Across the Globe. Retrieved June 9, 2021.

    Open source URL
  29. [29]
    DOJ North Korea Indictment Feb 2021

    Department of Justice. (2021, February 17). Three North Korean Military Hackers Indicted in Wide-Ranging Scheme to Commit Cyberattacks and Financial Crimes Across the Globe. Retrieved June 9, 2021.

    Open source URL
  30. [30]
    FireEye APT38 Oct 2018

    FireEye. (2018, October 03). APT38: Un-usual Suspects. Retrieved November 17, 2024.

    Open source URL
  31. [31]
    FireEye APT38 Oct 2018

    FireEye. (2018, October 03). APT38: Un-usual Suspects. Retrieved November 17, 2024.

    Open source URL
  32. [32]
    Kaspersky Lazarus Under The Hood Blog 2017

    GReAT. (2017, April 3). Lazarus Under the Hood. Retrieved April 17, 2019.

    Open source URL
  33. [33]
    Kaspersky Lazarus Under The Hood Blog 2017

    GReAT. (2017, April 3). Lazarus Under the Hood. Retrieved April 17, 2019.

    Open source URL
  34. [34]
    Microsoft Threat Actor Naming July 2023

    Microsoft . (2023, July 12). How Microsoft names threat actors. Retrieved November 17, 2023.

    Open source URL
  35. [35]
    Microsoft Threat Actor Naming July 2023

    Microsoft . (2023, July 12). How Microsoft names threat actors. Retrieved November 17, 2023.

    Open source URL
  36. [36]
    Microsoft Threat Actor Naming July 2023

    Microsoft . (2023, July 12). How Microsoft names threat actors. Retrieved November 17, 2023.

    Open source URL
  37. [37]
    NICKEL GLADSTONE

    (Citation: SecureWorks NICKEL GLADSTONE profile Sept 2021)

  38. [38]
    NICKEL GLADSTONE

    (Citation: SecureWorks NICKEL GLADSTONE profile Sept 2021)

  39. [39]
    NICKEL GLADSTONE

    (Citation: SecureWorks NICKEL GLADSTONE profile Sept 2021)

  40. [40]
    Sapphire Sleet

    (Citation: Microsoft Threat Actor Naming July 2023)

  41. [41]
    Sapphire Sleet

    (Citation: Microsoft Threat Actor Naming July 2023)

  42. [42]
    Sapphire Sleet

    (Citation: Microsoft Threat Actor Naming July 2023)

  43. [43]
    SecureWorks NICKEL GLADSTONE profile Sept 2021

    SecureWorks. (2021, September 29). NICKEL GLADSTONE Threat Profile. Retrieved September 29, 2021.

    Open source URL
  44. [44]
    SecureWorks NICKEL GLADSTONE profile Sept 2021

    SecureWorks. (2021, September 29). NICKEL GLADSTONE Threat Profile. Retrieved September 29, 2021.

    Open source URL
  45. [45]
    SecureWorks NICKEL GLADSTONE profile Sept 2021

    SecureWorks. (2021, September 29). NICKEL GLADSTONE Threat Profile. Retrieved September 29, 2021.

    Open source URL
  46. [46]
    Stardust Chollima

    (Citation: CrowdStrike Stardust Chollima Profile April 2018)(Citation: CrowdStrike GTR 2021 June 2021)

  47. [47]
    Stardust Chollima

    (Citation: CrowdStrike Stardust Chollima Profile April 2018)(Citation: CrowdStrike GTR 2021 June 2021)

  48. [48]
    Stardust Chollima

    (Citation: CrowdStrike Stardust Chollima Profile April 2018)(Citation: CrowdStrike GTR 2021 June 2021)

  49. [49]
    mitre-attackG0082
    Open source URL
  50. [50]
    mitre-attackG0082
    Open source URL
  51. [51]
    mitre-attackG0082
    Open source URL
  52. [52]
    FireEye APT38 Oct 2018

    FireEye. (2018, October 03). APT38: Un-usual Suspects. Retrieved November 17, 2024.

    Open source URL
  53. [53]
    FireEye APT38 Oct 2018

    FireEye. (2018, October 03). APT38: Un-usual Suspects. Retrieved November 17, 2024.

    Open source URL
  54. [54]
    1 - appv

    SEONGSU PARK. (2022, December 27). BlueNoroff introduces new methods bypassing MoTW. Retrieved February 6, 2024.

    Open source URL
  55. [55]
    CISA AA20-239A BeagleBoyz August 2020

    DHS/CISA. (2020, August 26). FASTCash 2.0: North Korea's BeagleBoyz Robbing Banks. Retrieved September 29, 2021.

    Open source URL
  56. [56]
    CISA AA20-239A BeagleBoyz August 2020

    DHS/CISA. (2020, August 26). FASTCash 2.0: North Korea's BeagleBoyz Robbing Banks. Retrieved September 29, 2021.

    Open source URL
  57. [57]
    FireEye APT38 Oct 2018

    FireEye. (2018, October 03). APT38: Un-usual Suspects. Retrieved November 17, 2024.

    Open source URL
  58. [58]
    FireEye APT38 Oct 2018

    FireEye. (2018, October 03). APT38: Un-usual Suspects. Retrieved November 17, 2024.

    Open source URL
  59. [59]
    CISA AA20-239A BeagleBoyz August 2020

    DHS/CISA. (2020, August 26). FASTCash 2.0: North Korea's BeagleBoyz Robbing Banks. Retrieved September 29, 2021.

    Open source URL
  60. [60]
    CISA AA20-239A BeagleBoyz August 2020

    DHS/CISA. (2020, August 26). FASTCash 2.0: North Korea's BeagleBoyz Robbing Banks. Retrieved September 29, 2021.

    Open source URL
  61. [61]
    FireEye APT38 Oct 2018

    FireEye. (2018, October 03). APT38: Un-usual Suspects. Retrieved November 17, 2024.

    Open source URL
  62. [62]
    FireEye APT38 Oct 2018

    FireEye. (2018, October 03). APT38: Un-usual Suspects. Retrieved November 17, 2024.

    Open source URL
  63. [63]
    CISA AA20-239A BeagleBoyz August 2020

    DHS/CISA. (2020, August 26). FASTCash 2.0: North Korea's BeagleBoyz Robbing Banks. Retrieved September 29, 2021.

    Open source URL
  64. [64]
    CISA AA20-239A BeagleBoyz August 2020

    DHS/CISA. (2020, August 26). FASTCash 2.0: North Korea's BeagleBoyz Robbing Banks. Retrieved September 29, 2021.

    Open source URL
  65. [65]
    FireEye APT38 Oct 2018

    FireEye. (2018, October 03). APT38: Un-usual Suspects. Retrieved November 17, 2024.

    Open source URL
  66. [66]
    FireEye APT38 Oct 2018

    FireEye. (2018, October 03). APT38: Un-usual Suspects. Retrieved November 17, 2024.

    Open source URL
  67. [67]
    1 - appv

    SEONGSU PARK. (2022, December 27). BlueNoroff introduces new methods bypassing MoTW. Retrieved February 6, 2024.

    Open source URL
  68. [68]
    1 - appv

    SEONGSU PARK. (2022, December 27). BlueNoroff introduces new methods bypassing MoTW. Retrieved February 6, 2024.

    Open source URL
  69. [69]
    FireEye APT38 Oct 2018

    FireEye. (2018, October 03). APT38: Un-usual Suspects. Retrieved November 17, 2024.

    Open source URL
  70. [70]
    FireEye APT38 Oct 2018

    FireEye. (2018, October 03). APT38: Un-usual Suspects. Retrieved November 17, 2024.

    Open source URL
  71. [71]
    1 - appv

    SEONGSU PARK. (2022, December 27). BlueNoroff introduces new methods bypassing MoTW. Retrieved February 6, 2024.

    Open source URL
  72. [72]
    1 - appv

    SEONGSU PARK. (2022, December 27). BlueNoroff introduces new methods bypassing MoTW. Retrieved February 6, 2024.

    Open source URL
  73. [73]
    CISA AA20-239A BeagleBoyz August 2020

    DHS/CISA. (2020, August 26). FASTCash 2.0: North Korea's BeagleBoyz Robbing Banks. Retrieved September 29, 2021.

    Open source URL
  74. [74]
    CISA AA20-239A BeagleBoyz August 2020

    DHS/CISA. (2020, August 26). FASTCash 2.0: North Korea's BeagleBoyz Robbing Banks. Retrieved September 29, 2021.

    Open source URL
  75. [75]
    FireEye APT38 Oct 2018

    FireEye. (2018, October 03). APT38: Un-usual Suspects. Retrieved November 17, 2024.

    Open source URL
  76. [76]
    FireEye APT38 Oct 2018

    FireEye. (2018, October 03). APT38: Un-usual Suspects. Retrieved November 17, 2024.

    Open source URL
  77. [77]
    CISA AA20-239A BeagleBoyz August 2020

    DHS/CISA. (2020, August 26). FASTCash 2.0: North Korea's BeagleBoyz Robbing Banks. Retrieved September 29, 2021.

    Open source URL
  78. [78]
    CISA AA20-239A BeagleBoyz August 2020

    DHS/CISA. (2020, August 26). FASTCash 2.0: North Korea's BeagleBoyz Robbing Banks. Retrieved September 29, 2021.

    Open source URL
  79. [79]
    1 - appv

    SEONGSU PARK. (2022, December 27). BlueNoroff introduces new methods bypassing MoTW. Retrieved February 6, 2024.

    Open source URL
  80. [80]
    1 - appv

    SEONGSU PARK. (2022, December 27). BlueNoroff introduces new methods bypassing MoTW. Retrieved February 6, 2024.

    Open source URL
  81. [81]
    CISA AA20-239A BeagleBoyz August 2020

    DHS/CISA. (2020, August 26). FASTCash 2.0: North Korea's BeagleBoyz Robbing Banks. Retrieved September 29, 2021.

    Open source URL
  82. [82]
    CISA AA20-239A BeagleBoyz August 2020

    DHS/CISA. (2020, August 26). FASTCash 2.0: North Korea's BeagleBoyz Robbing Banks. Retrieved September 29, 2021.

    Open source URL
  83. [83]
    FireEye APT38 Oct 2018

    FireEye. (2018, October 03). APT38: Un-usual Suspects. Retrieved November 17, 2024.

    Open source URL
  84. [84]
    FireEye APT38 Oct 2018

    FireEye. (2018, October 03). APT38: Un-usual Suspects. Retrieved November 17, 2024.

    Open source URL
  85. [85]
    CISA AA20-239A BeagleBoyz August 2020

    DHS/CISA. (2020, August 26). FASTCash 2.0: North Korea's BeagleBoyz Robbing Banks. Retrieved September 29, 2021.

    Open source URL
  86. [86]
    CISA AA20-239A BeagleBoyz August 2020

    DHS/CISA. (2020, August 26). FASTCash 2.0: North Korea's BeagleBoyz Robbing Banks. Retrieved September 29, 2021.

    Open source URL
  87. [87]
    1 - appv

    SEONGSU PARK. (2022, December 27). BlueNoroff introduces new methods bypassing MoTW. Retrieved February 6, 2024.

    Open source URL
  88. [88]
    1 - appv

    SEONGSU PARK. (2022, December 27). BlueNoroff introduces new methods bypassing MoTW. Retrieved February 6, 2024.

    Open source URL
  89. [89]
    FireEye APT38 Oct 2018

    FireEye. (2018, October 03). APT38: Un-usual Suspects. Retrieved November 17, 2024.

    Open source URL
  90. [90]
    FireEye APT38 Oct 2018

    FireEye. (2018, October 03). APT38: Un-usual Suspects. Retrieved November 17, 2024.

    Open source URL
  91. [91]
    1 - appv

    SEONGSU PARK. (2022, December 27). BlueNoroff introduces new methods bypassing MoTW. Retrieved February 6, 2024.

    Open source URL
  92. [92]
    1 - appv

    SEONGSU PARK. (2022, December 27). BlueNoroff introduces new methods bypassing MoTW. Retrieved February 6, 2024.

    Open source URL
  93. [93]
    CISA AA20-239A BeagleBoyz August 2020

    DHS/CISA. (2020, August 26). FASTCash 2.0: North Korea's BeagleBoyz Robbing Banks. Retrieved September 29, 2021.

    Open source URL
  94. [94]
    CISA AA20-239A BeagleBoyz August 2020

    DHS/CISA. (2020, August 26). FASTCash 2.0: North Korea's BeagleBoyz Robbing Banks. Retrieved September 29, 2021.

    Open source URL
  95. [95]
    1 - appv

    SEONGSU PARK. (2022, December 27). BlueNoroff introduces new methods bypassing MoTW. Retrieved February 6, 2024.

    Open source URL
  96. [96]
    1 - appv

    SEONGSU PARK. (2022, December 27). BlueNoroff introduces new methods bypassing MoTW. Retrieved February 6, 2024.

    Open source URL
  97. [97]
    CISA AA20-239A BeagleBoyz August 2020

    DHS/CISA. (2020, August 26). FASTCash 2.0: North Korea's BeagleBoyz Robbing Banks. Retrieved September 29, 2021.

    Open source URL
  98. [98]
    CISA AA20-239A BeagleBoyz August 2020

    DHS/CISA. (2020, August 26). FASTCash 2.0: North Korea's BeagleBoyz Robbing Banks. Retrieved September 29, 2021.

    Open source URL
  99. [99]
    FireEye APT38 Oct 2018

    FireEye. (2018, October 03). APT38: Un-usual Suspects. Retrieved November 17, 2024.

    Open source URL
  100. [100]
    FireEye APT38 Oct 2018

    FireEye. (2018, October 03). APT38: Un-usual Suspects. Retrieved November 17, 2024.

    Open source URL
  101. [101]
    1 - appv

    SEONGSU PARK. (2022, December 27). BlueNoroff introduces new methods bypassing MoTW. Retrieved February 6, 2024.

    Open source URL
  102. [102]
    1 - appv

    SEONGSU PARK. (2022, December 27). BlueNoroff introduces new methods bypassing MoTW. Retrieved February 6, 2024.

    Open source URL
  103. [103]
    FireEye APT38 Oct 2018

    FireEye. (2018, October 03). APT38: Un-usual Suspects. Retrieved November 17, 2024.

    Open source URL
  104. [104]
    FireEye APT38 Oct 2018

    FireEye. (2018, October 03). APT38: Un-usual Suspects. Retrieved November 17, 2024.

    Open source URL
  105. [105]
    1 - appv

    SEONGSU PARK. (2022, December 27). BlueNoroff introduces new methods bypassing MoTW. Retrieved February 6, 2024.

    Open source URL
  106. [106]
    1 - appv

    SEONGSU PARK. (2022, December 27). BlueNoroff introduces new methods bypassing MoTW. Retrieved February 6, 2024.

    Open source URL
  107. [107]
    FireEye APT38 Oct 2018

    FireEye. (2018, October 03). APT38: Un-usual Suspects. Retrieved November 17, 2024.

    Open source URL
  108. [108]
    FireEye APT38 Oct 2018

    FireEye. (2018, October 03). APT38: Un-usual Suspects. Retrieved November 17, 2024.

    Open source URL
  109. [109]
    1 - appv

    SEONGSU PARK. (2022, December 27). BlueNoroff introduces new methods bypassing MoTW. Retrieved February 6, 2024.

    Open source URL
  110. [110]
    1 - appv

    SEONGSU PARK. (2022, December 27). BlueNoroff introduces new methods bypassing MoTW. Retrieved February 6, 2024.

    Open source URL
  111. [111]
    FireEye APT38 Oct 2018

    FireEye. (2018, October 03). APT38: Un-usual Suspects. Retrieved November 17, 2024.

    Open source URL
  112. [112]
    FireEye APT38 Oct 2018

    FireEye. (2018, October 03). APT38: Un-usual Suspects. Retrieved November 17, 2024.

    Open source URL
  113. [113]
    CISA AA20-239A BeagleBoyz August 2020

    DHS/CISA. (2020, August 26). FASTCash 2.0: North Korea's BeagleBoyz Robbing Banks. Retrieved September 29, 2021.

    Open source URL
  114. [114]
    CISA AA20-239A BeagleBoyz August 2020

    DHS/CISA. (2020, August 26). FASTCash 2.0: North Korea's BeagleBoyz Robbing Banks. Retrieved September 29, 2021.

    Open source URL
  115. [115]
    FireEye APT38 Oct 2018

    FireEye. (2018, October 03). APT38: Un-usual Suspects. Retrieved November 17, 2024.

    Open source URL
  116. [116]
    FireEye APT38 Oct 2018

    FireEye. (2018, October 03). APT38: Un-usual Suspects. Retrieved November 17, 2024.

    Open source URL
  117. [117]
    1 - appv

    SEONGSU PARK. (2022, December 27). BlueNoroff introduces new methods bypassing MoTW. Retrieved February 6, 2024.

    Open source URL
  118. [118]
    1 - appv

    SEONGSU PARK. (2022, December 27). BlueNoroff introduces new methods bypassing MoTW. Retrieved February 6, 2024.

    Open source URL
  119. [119]
    CISA AA20-239A BeagleBoyz August 2020

    DHS/CISA. (2020, August 26). FASTCash 2.0: North Korea's BeagleBoyz Robbing Banks. Retrieved September 29, 2021.

    Open source URL
  120. [120]
    CISA AA20-239A BeagleBoyz August 2020

    DHS/CISA. (2020, August 26). FASTCash 2.0: North Korea's BeagleBoyz Robbing Banks. Retrieved September 29, 2021.

    Open source URL
  121. [121]
    CISA AA20-239A BeagleBoyz August 2020

    DHS/CISA. (2020, August 26). FASTCash 2.0: North Korea's BeagleBoyz Robbing Banks. Retrieved September 29, 2021.

    Open source URL
  122. [122]
    CISA AA20-239A BeagleBoyz August 2020

    DHS/CISA. (2020, August 26). FASTCash 2.0: North Korea's BeagleBoyz Robbing Banks. Retrieved September 29, 2021.

    Open source URL
  123. [123]
    FireEye APT38 Oct 2018

    FireEye. (2018, October 03). APT38: Un-usual Suspects. Retrieved November 17, 2024.

    Open source URL
  124. [124]
    FireEye APT38 Oct 2018

    FireEye. (2018, October 03). APT38: Un-usual Suspects. Retrieved November 17, 2024.

    Open source URL
  125. [125]
    CISA AA20-239A BeagleBoyz August 2020

    DHS/CISA. (2020, August 26). FASTCash 2.0: North Korea's BeagleBoyz Robbing Banks. Retrieved September 29, 2021.

    Open source URL
  126. [126]
    CISA AA20-239A BeagleBoyz August 2020

    DHS/CISA. (2020, August 26). FASTCash 2.0: North Korea's BeagleBoyz Robbing Banks. Retrieved September 29, 2021.

    Open source URL
  127. [127]
    CISA AA20-239A BeagleBoyz August 2020

    DHS/CISA. (2020, August 26). FASTCash 2.0: North Korea's BeagleBoyz Robbing Banks. Retrieved September 29, 2021.

    Open source URL
  128. [128]
    CISA AA20-239A BeagleBoyz August 2020

    DHS/CISA. (2020, August 26). FASTCash 2.0: North Korea's BeagleBoyz Robbing Banks. Retrieved September 29, 2021.

    Open source URL
  129. [129]
    1 - appv

    SEONGSU PARK. (2022, December 27). BlueNoroff introduces new methods bypassing MoTW. Retrieved February 6, 2024.

    Open source URL
  130. [130]
    1 - appv

    SEONGSU PARK. (2022, December 27). BlueNoroff introduces new methods bypassing MoTW. Retrieved February 6, 2024.

    Open source URL
  131. [131]
    CISA AA20-239A BeagleBoyz August 2020

    DHS/CISA. (2020, August 26). FASTCash 2.0: North Korea's BeagleBoyz Robbing Banks. Retrieved September 29, 2021.

    Open source URL
  132. [132]
    CISA AA20-239A BeagleBoyz August 2020

    DHS/CISA. (2020, August 26). FASTCash 2.0: North Korea's BeagleBoyz Robbing Banks. Retrieved September 29, 2021.

    Open source URL
  133. [133]
    FireEye APT38 Oct 2018

    FireEye. (2018, October 03). APT38: Un-usual Suspects. Retrieved November 17, 2024.

    Open source URL
  134. [134]
    FireEye APT38 Oct 2018

    FireEye. (2018, October 03). APT38: Un-usual Suspects. Retrieved November 17, 2024.

    Open source URL
  135. [135]
    CISA AA20-239A BeagleBoyz August 2020

    DHS/CISA. (2020, August 26). FASTCash 2.0: North Korea's BeagleBoyz Robbing Banks. Retrieved September 29, 2021.

    Open source URL
  136. [136]
    CISA AA20-239A BeagleBoyz August 2020

    DHS/CISA. (2020, August 26). FASTCash 2.0: North Korea's BeagleBoyz Robbing Banks. Retrieved September 29, 2021.

    Open source URL
  137. [137]
    FireEye APT38 Oct 2018

    FireEye. (2018, October 03). APT38: Un-usual Suspects. Retrieved November 17, 2024.

    Open source URL
  138. [138]
    FireEye APT38 Oct 2018

    FireEye. (2018, October 03). APT38: Un-usual Suspects. Retrieved November 17, 2024.

    Open source URL
  139. [139]
    1 - appv

    SEONGSU PARK. (2022, December 27). BlueNoroff introduces new methods bypassing MoTW. Retrieved February 6, 2024.

    Open source URL
  140. [140]
    1 - appv

    SEONGSU PARK. (2022, December 27). BlueNoroff introduces new methods bypassing MoTW. Retrieved February 6, 2024.

    Open source URL
  141. [141]
    CISA AA20-239A BeagleBoyz August 2020

    DHS/CISA. (2020, August 26). FASTCash 2.0: North Korea's BeagleBoyz Robbing Banks. Retrieved September 29, 2021.

    Open source URL
  142. [142]
    CISA AA20-239A BeagleBoyz August 2020

    DHS/CISA. (2020, August 26). FASTCash 2.0: North Korea's BeagleBoyz Robbing Banks. Retrieved September 29, 2021.

    Open source URL
  143. [143]
    1 - appv

    SEONGSU PARK. (2022, December 27). BlueNoroff introduces new methods bypassing MoTW. Retrieved February 6, 2024.

    Open source URL
  144. [144]
    1 - appv

    SEONGSU PARK. (2022, December 27). BlueNoroff introduces new methods bypassing MoTW. Retrieved February 6, 2024.

    Open source URL
  145. [145]
    CISA AA20-239A BeagleBoyz August 2020

    DHS/CISA. (2020, August 26). FASTCash 2.0: North Korea's BeagleBoyz Robbing Banks. Retrieved September 29, 2021.

    Open source URL
  146. [146]
    CISA AA20-239A BeagleBoyz August 2020

    DHS/CISA. (2020, August 26). FASTCash 2.0: North Korea's BeagleBoyz Robbing Banks. Retrieved September 29, 2021.

    Open source URL
  147. [147]
    ESET Lazarus KillDisk April 2018

    Kálnai, P., Cherepanov A. (2018, April 03). Lazarus KillDisks Central American casino. Retrieved May 17, 2018.

    Open source URL
  148. [148]
    CISA AA20-239A BeagleBoyz August 2020

    DHS/CISA. (2020, August 26). FASTCash 2.0: North Korea's BeagleBoyz Robbing Banks. Retrieved September 29, 2021.

    Open source URL
  149. [149]
    CISA AA20-239A BeagleBoyz August 2020

    DHS/CISA. (2020, August 26). FASTCash 2.0: North Korea's BeagleBoyz Robbing Banks. Retrieved September 29, 2021.

    Open source URL
  150. [150]
    FireEye APT38 Oct 2018

    FireEye. (2018, October 03). APT38: Un-usual Suspects. Retrieved November 17, 2024.

    Open source URL
  151. [151]
    FireEye APT38 Oct 2018

    FireEye. (2018, October 03). APT38: Un-usual Suspects. Retrieved November 17, 2024.

    Open source URL
  152. [152]
    FireEye APT38 Oct 2018

    FireEye. (2018, October 03). APT38: Un-usual Suspects. Retrieved November 17, 2024.

    Open source URL
  153. [153]
    FireEye APT38 Oct 2018

    FireEye. (2018, October 03). APT38: Un-usual Suspects. Retrieved November 17, 2024.

    Open source URL
  154. [154]
    1 - appv

    SEONGSU PARK. (2022, December 27). BlueNoroff introduces new methods bypassing MoTW. Retrieved February 6, 2024.

    Open source URL
  155. [155]
    1 - appv

    SEONGSU PARK. (2022, December 27). BlueNoroff introduces new methods bypassing MoTW. Retrieved February 6, 2024.

    Open source URL
  156. [156]
    CISA AA20-239A BeagleBoyz August 2020

    DHS/CISA. (2020, August 26). FASTCash 2.0: North Korea's BeagleBoyz Robbing Banks. Retrieved September 29, 2021.

    Open source URL
  157. [157]
    CISA AA20-239A BeagleBoyz August 2020

    DHS/CISA. (2020, August 26). FASTCash 2.0: North Korea's BeagleBoyz Robbing Banks. Retrieved September 29, 2021.

    Open source URL
  158. [158]
    FireEye APT38 Oct 2018

    FireEye. (2018, October 03). APT38: Un-usual Suspects. Retrieved November 17, 2024.

    Open source URL
  159. [159]
    FireEye APT38 Oct 2018

    FireEye. (2018, October 03). APT38: Un-usual Suspects. Retrieved November 17, 2024.

    Open source URL
  160. [160]
    1 - appv

    SEONGSU PARK. (2022, December 27). BlueNoroff introduces new methods bypassing MoTW. Retrieved February 6, 2024.

    Open source URL
  161. [161]
    1 - appv

    SEONGSU PARK. (2022, December 27). BlueNoroff introduces new methods bypassing MoTW. Retrieved February 6, 2024.

    Open source URL
  162. [162]
    CISA AA20-239A BeagleBoyz August 2020

    DHS/CISA. (2020, August 26). FASTCash 2.0: North Korea's BeagleBoyz Robbing Banks. Retrieved September 29, 2021.

    Open source URL
  163. [163]
    CISA AA20-239A BeagleBoyz August 2020

    DHS/CISA. (2020, August 26). FASTCash 2.0: North Korea's BeagleBoyz Robbing Banks. Retrieved September 29, 2021.

    Open source URL
  164. [164]
    ESET Lazarus KillDisk April 2018

    Kálnai, P., Cherepanov A. (2018, April 03). Lazarus KillDisks Central American casino. Retrieved May 17, 2018.

    Open source URL
  165. [165]
    ESET Lazarus KillDisk April 2018

    Kálnai, P., Cherepanov A. (2018, April 03). Lazarus KillDisks Central American casino. Retrieved May 17, 2018.

    Open source URL
  166. [166]
    Kaspersky Lazarus Under The Hood APR 2017

    GReAT. (2017, April 3). Lazarus Under the Hood. Retrieved October 3, 2018.

    Open source URL
  167. [167]
    1 - appv

    SEONGSU PARK. (2022, December 27). BlueNoroff introduces new methods bypassing MoTW. Retrieved February 6, 2024.

    Open source URL
  168. [168]
    1 - appv

    SEONGSU PARK. (2022, December 27). BlueNoroff introduces new methods bypassing MoTW. Retrieved February 6, 2024.

    Open source URL
  169. [169]
    CISA AA20-239A BeagleBoyz August 2020

    DHS/CISA. (2020, August 26). FASTCash 2.0: North Korea's BeagleBoyz Robbing Banks. Retrieved September 29, 2021.

    Open source URL
  170. [170]
    CISA AA20-239A BeagleBoyz August 2020

    DHS/CISA. (2020, August 26). FASTCash 2.0: North Korea's BeagleBoyz Robbing Banks. Retrieved September 29, 2021.

    Open source URL
  171. [171]
    FireEye APT38 Oct 2018

    FireEye. (2018, October 03). APT38: Un-usual Suspects. Retrieved November 17, 2024.

    Open source URL
  172. [172]
    FireEye APT38 Oct 2018

    FireEye. (2018, October 03). APT38: Un-usual Suspects. Retrieved November 17, 2024.

    Open source URL
  173. [173]
    CISA AA20-239A BeagleBoyz August 2020

    DHS/CISA. (2020, August 26). FASTCash 2.0: North Korea's BeagleBoyz Robbing Banks. Retrieved September 29, 2021.

    Open source URL
  174. [174]
    CISA AA20-239A BeagleBoyz August 2020

    DHS/CISA. (2020, August 26). FASTCash 2.0: North Korea's BeagleBoyz Robbing Banks. Retrieved September 29, 2021.

    Open source URL
  175. [175]
    CISA AA20-239A BeagleBoyz August 2020

    DHS/CISA. (2020, August 26). FASTCash 2.0: North Korea's BeagleBoyz Robbing Banks. Retrieved September 29, 2021.

    Open source URL
  176. [176]
    CISA AA20-239A BeagleBoyz August 2020

    DHS/CISA. (2020, August 26). FASTCash 2.0: North Korea's BeagleBoyz Robbing Banks. Retrieved September 29, 2021.

    Open source URL
  177. [177]
    CISA AA20-239A BeagleBoyz August 2020

    DHS/CISA. (2020, August 26). FASTCash 2.0: North Korea's BeagleBoyz Robbing Banks. Retrieved September 29, 2021.

    Open source URL
  178. [178]
    CISA AA20-239A BeagleBoyz August 2020

    DHS/CISA. (2020, August 26). FASTCash 2.0: North Korea's BeagleBoyz Robbing Banks. Retrieved September 29, 2021.

    Open source URL
  179. [179]
    1 - appv

    SEONGSU PARK. (2022, December 27). BlueNoroff introduces new methods bypassing MoTW. Retrieved February 6, 2024.

    Open source URL
  180. [180]
    FireEye APT38 Oct 2018

    FireEye. (2018, October 03). APT38: Un-usual Suspects. Retrieved November 17, 2024.

    Open source URL
  181. [181]
    CISA AA20-239A BeagleBoyz August 2020

    DHS/CISA. (2020, August 26). FASTCash 2.0: North Korea's BeagleBoyz Robbing Banks. Retrieved September 29, 2021.

    Open source URL
  182. [182]
    1 - appv

    SEONGSU PARK. (2022, December 27). BlueNoroff introduces new methods bypassing MoTW. Retrieved February 6, 2024.

    Open source URL
  183. [183]
    FireEye APT38 Oct 2018

    FireEye. (2018, October 03). APT38: Un-usual Suspects. Retrieved November 17, 2024.

    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK siteOfficial STIX data repositoryMITRE ATT&CK terms of use