APT ATLAS

⌘K

Atlas Actors145 Names507 Sectors40

Famous Chollima (aka Wagemole, Nickel Tapestry) · APT Atlas

Actors/Nation-state / APT/Asia

Famous Chollima

APTKP · North Korea

AKA Wagemole · Nickel Tapestry · Jasper Sleet

Mandiant: UNC5267Microsoft: DEV-0530

DPRK IT-worker fraud operation.

Targets25

Sectors16

Threat types1

GIRs mapped0/480

Active since2018

Explore in atlas

Export

STIX 2.1 ATT&CK Navigator

QUICK FACTS

TypeNation-state / APT

OriginNorth Korea

First seen2018

Type (verbatim)nation-state APT

GIR mappings0/480

TTPs0

Targets25

Sectors16

Record updated2026-08-03

Also tracked as

3 vendor names · 3 other aliases

Open Rosetta Stone

CrowdStrike

Famous Chollima

Mandiant

UNC5267

Microsoft

DEV-0530

UNATTRIBUTED ALIASESWagemoleNickel TapestryJasper Sleet

Victimology

Geographic footprint · 25 countries

Export STIX

origin · North Koreatargeted countries · 25

ASIA · 11

United Arab Emirates · Hong Kong · Indonesia · India · Iran · Japan · Kazakhstan · Malaysia · Philippines · Türkiye · Vietnam

AMERICAS · 6

Argentina · Brazil · Canada · Costa Rica · Guatemala · Uruguay

EUROPE · 8

Cyprus · Germany · Estonia · France · United Kingdom · Italy · Netherlands · Ukraine

Sectors targeted

16 of 40

Government100 actors Defense72 actors Aviation22 actors Financial Services73 actors Cryptocurrency20 actors Pharmaceutical26 actors Technology60 actors Telecom71 actors Retail & Hospitality32 actors Education & Research62 actors Manufacturing (man)49 actors Transportation31 actors Logistics21 actors Hospitality32 actors Consulting / Professional Services34 actors Maritime24 actors

Tactics, techniques, procedures

Threat types + MITRE ATT&CK mapping

THREAT TYPES

FIN · Financial Fraud

MITRE ATT&CK · 0 techniques

No TTPs mapped yet.

GIR mappings

0 / 480 requirements mapped

Open matrix

No GIRs mapped yet for this actor.

References

No supporting references have been recorded for this profile. Treat uncited claims as unverified.

Open data

Machine-readable exports of this profile

JSON · RESTActor recordFull profile via the public v1 API STIX 2.1Intrusion-set bundleDeterministic ids · techniques + targeted countries ATT&CK NAVIGATORTechnique layer0 techniques · layer format 4.5

Related actors

By origin and actor type

Agriusnation-state

Iran · 2 targets · since 2020

AppleJeusnation-state

North Korea · 25 targets · since 2018

APT1nation-state

China · 17 targets · since 2006

APT10nation-state

China · 19 targets · since 2009

APT12nation-state

China · 11 targets · since 2009

APT14nation-state

China · 15 targets · since —