Atlas Actors147 Names471 Sectors40 Requirements480

⌘K

Atlas Actors147 Names471 Sectors40 Requirements480

APT45 (aka Andariel, LABYRINTH CHOLLIMA) · APT Atlas

Actors/Nation-state / APT/Asia

APT45

G0138APTKP · North Korea

AKA Andariel · LABYRINTH CHOLLIMA · Onyx Sleet · Operation Troy · DarkSeoul · Stonefly · Nickel Hyatt

CrowdStrike: SILENT CHOLLIMAMicrosoft: PLUTONIUMMITRE: G0138Proofpoint: TA404Secureworks: IRON TILDEN

Targets25

Sectors18

Threat types2

GIRs covered0/480

Active since2009

QUICK FACTS

TypeNation-state / APT

OriginNorth Korea

First seen2009

Type (verbatim)nation-state APT

GIR coverage0/480

TTPs9

Targets25

Sectors18

Last reviewed2026-07-29

Also tracked as

6 vendor names · 7 other aliases

Open Rosetta Stone

CrowdStrike

SILENT CHOLLIMA

Mandiant

APT45

Microsoft

PLUTONIUM

MITRE

G0138

Proofpoint

TA404

Secureworks

IRON TILDEN

UNATTRIBUTED ALIASESAndarielLABYRINTH CHOLLIMAOnyx SleetOperation TroyDarkSeoulStoneflyNickel Hyatt

Victimology

Geographic footprint · 25 countries

origin · North Koreatargeted countries · 25

AMERICAS · 4

Argentina · Brazil · Canada · United States

OCEANIA · 1

Australia

EUROPE · 12

Belgium · Switzerland · Germany · Denmark · Estonia · Hungary · Norway · Poland · Romania · Russia · Sweden · Slovenia

ASIA · 8

China · Israel · India · Japan · South Korea · Philippines · Türkiye · Vietnam

Sectors targeted

18 of 40

Government100 actors Defense72 actors Aerospace59 actors Financial Services74 actors Healthcare47 actors Pharmaceutical27 actors Telecom72 actors Retail & Hospitality33 actors Energy / Utilities59 actors Education & Research62 actors Manufacturing (man)50 actors Media & Journalism49 actors Hospitality33 actors Consulting / Professional Services35 actors Chemicals20 actors Consumer Goods / Electronics20 actors Agriculture & Food18 actors Maritime24 actors

Tactics, techniques, procedures

Threat types + MITRE ATT&CK mapping

THREAT TYPES

ESP · EspionageRAN · Ransomware

MITRE ATT&CK · 9 techniques

Reconnaissance · 1

T1592.002Software

Initial Access · 2

T1189Drive-by Compromise

Execution · 1

T1203Exploitation for Client Execution

Discovery · 2

T1049System Network Connections Discovery

Collection · 1

T1005Data from Local System

Command And Control · 1

T1105Ingress Tool Transfer

Stealth · 1

T1027.003Steganography

GIR coverage

0 / 480 requirements satisfied

Open matrix

No GIRs mapped yet for this actor.

Open data

Machine-readable exports of this profile

JSON · RESTActor recordFull profile via the public v1 API STIX 2.1Intrusion-set bundleDeterministic ids · techniques + targeted countries ATT&CK NAVIGATORTechnique layer9 techniques · layer format 4.5

Related actors

By origin and actor type

APT31nation-state

China · 6 targets · since 2013

APT8nation-state

China · 5 targets · since —

APT24nation-state

China · 3 targets · since 2008

APT27nation-state

China · 23 targets · since 2010

APT44nation-state

Russia · 25 targets · since 2009

APT21nation-state

China · 5 targets · since 2010

T1566.001

Spearphishing Attachment

T1057

Process Discovery