Actors/Nation-state / APT/Asia

UNC2970

APTKP · North Korea

AKA Zinc

CrowdStrike: LABYRINTH CHOLLIMAKaspersky: BluenoroffMicrosoft: Diamond Sleet

Targets25

Sectors18

Threat types1

GIRs covered0/480

Active since—

Also tracked as

4 vendor names · 1 other aliases

Open Rosetta Stone

CrowdStrike

LABYRINTH CHOLLIMA

Kaspersky

Bluenoroff

Mandiant

UNC2970

Microsoft

Diamond Sleet

UNATTRIBUTED ALIASESZinc

Victimology

Geographic footprint · 25 countries

origin · North Koreatargeted countries · 25

AMERICAS · 3

Argentina · Brazil · Canada

EUROPE · 14

Belgium · Germany · Denmark · Estonia · Spain · United Kingdom · Hungary · Italy · Netherlands · Poland · Russia · Sweden · Slovenia · Ukraine

ASIA · 6

Israel · India · Japan · South Korea · Türkiye · Vietnam

OCEANIA · 1

New Zealand

AFRICA · 1

South Africa

Sectors targeted

18 of 40

Government100 actors Defense72 actors Aerospace59 actors Financial Services74 actors Cryptocurrency21 actors Healthcare47 actors Pharmaceutical27 actors Telecom72 actors Energy / Utilities59 actors Education & Research62 actors Manufacturing (man)50 actors Media & Journalism49 actors Transportation31 actors Consulting / Professional Services35 actors Industrials / Engineering29 actors Consumer Goods / Electronics20 actors Agriculture & Food18 actors Maritime24 actors

Tactics, techniques, procedures

Threat types + MITRE ATT&CK mapping

THREAT TYPES

ESP · Espionage

MITRE ATT&CK · 0 techniques

No TTPs mapped yet.

GIR coverage

0 / 480 requirements satisfied

Open matrix

No GIRs mapped yet for this actor.

Open data

Machine-readable exports of this profile

JSON · RESTActor recordFull profile via the public v1 API STIX 2.1Intrusion-set bundleDeterministic ids · techniques + targeted countries ATT&CK NAVIGATORTechnique layer0 techniques · layer format 4.5

Related actors

By origin and actor type