Actors/Nation-state / APT/Asia

APT38

G0082APTKP · North Korea

AKA CageyChameleon · Bluenoroff · Sapphire Sleet · BeagleBoyz

Microsoft: COPERNICIUMProofpoint: TA444CrowdStrike: STARDUST CHOLLIMASecureworks: NICKEL GLADSTONEMITRE: G0082

DPRK financial-heist cluster attributed to the Reconnaissance General Bureau.

Targets25

Sectors18

Threat types2

GIRs mapped0/480

Active since2014

Explore in atlas

Also tracked as

6 vendor names · 4 other aliases

Open Rosetta Stone

CrowdStrike

STARDUST CHOLLIMA

Mandiant

APT38

Microsoft

COPERNICIUM

MITRE

G0082

Proofpoint

TA444

Secureworks

NICKEL GLADSTONE

UNATTRIBUTED ALIASESCageyChameleonBluenoroffSapphire SleetBeagleBoyz

Victimology

Geographic footprint · 25 countries

Export STIX

origin · North Koreatargeted countries · 25

ASIA · 7

Bangladesh · Hong Kong · Indonesia · India · Lebanon · Thailand · Vietnam

AMERICAS · 8

Brazil · Chile · Colombia · Ecuador · Guatemala · Mexico · Uruguay · Venezuela

EUROPE · 7

Belarus · Czechia · Germany · Spain · United Kingdom · Poland · Russia

AFRICA · 3

Liberia · Tunisia · South Africa

Sectors targeted

18 of 40

Government100 actors Defense72 actors Financial Services73 actors Cryptocurrency20 actors Pharmaceutical26 actors Technology60 actors Telecom71 actors Energy / Utilities58 actors Education & Research62 actors Manufacturing (man)49 actors Transportation31 actors Hospitality32 actors Consulting / Professional Services34 actors Industrials / Engineering28 actors Private Sector (generic)29 actors Consumer Goods / Electronics19 actors Agriculture & Food18 actors Maritime24 actors

Tactics, techniques, procedures

Threat types + MITRE ATT&CK mapping

THREAT TYPES

ESP · EspionageFIN · Financial Fraud

MITRE ATT&CK · 40 techniques

Initial Access · 2

T1189Drive-by Compromise T1566.001Spearphishing Attachment

Execution · 7

T1053.003Cron

Persistence · 1

T1543.003Windows Service

Credential Access · 1

T1110Brute Force

Discovery · 6

T1033System Owner/User Discovery

Collection · 2

T1005Data from Local System T1115Clipboard Data

Impact · 5

T1485Data Destruction

Command And Control · 2

T1071.001Web Protocols

Defense Impairment · 4

T1112Modify Registry

Stealth · 10

T1027.002Software Packing T1036.003Rename Legitimate Utilities

GIR mappings

0 / 480 requirements mapped

Open matrix

No GIRs mapped yet for this actor.

References

No supporting references have been recorded for this profile. Treat uncited claims as unverified.

Open data

Machine-readable exports of this profile

JSON · RESTActor recordFull profile via the public v1 API STIX 2.1Intrusion-set bundleDeterministic ids · techniques + targeted countries ATT&CK NAVIGATORTechnique layer40 techniques · layer format 4.5

Related actors

By origin and actor type

T1053.005

Scheduled Task

T1059.001PowerShell

T1059.003Windows Command Shell

T1059.005Visual Basic

T1106Native API

T1204.001Malicious Link

T1049

System Network Connections Discovery

T1057Process Discovery

T1083File and Directory Discovery

T1135Network Share Discovery

T1217Browser Information Discovery

T1486

Data Encrypted for Impact

T1529System Shutdown/Reboot

T1561.002Disk Structure Wipe

T1565.002Transmitted Data Manipulation

T1105

Ingress Tool Transfer

T1685

Disable or Modify Tools

T1686Disable or Modify System Firewall

T1690Prevent Command History Logging

T1036.006

Space after Filename

T1055Process Injection

T1070.004File Deletion

T1140Deobfuscate/Decode Files or Information

T1218.001Compiled HTML File

T1218.005Mshta

T1218.007Msiexec

T1218.011Rundll32