AndarielG0138 ↗
VirusTotal tracks this as Lazarus Group.
Since 2009, HIDDEN COBRA actors have leveraged their capabilities to target and compromise a range of victims; some intrusions have resulted in the exfiltration of data while others have been disruptive in nature. Commercial reporting has referred to this activity as Lazarus Group and Guardians of Peace. Tools and capabilities used by HIDDEN COBRA actors include DDoS botnets, keyloggers, remote access tools (RATs), and wiper malware. Variants of malware and tools used by HIDDEN COBRA actors include Destover, Duuzer, and Hangman.
Targeted industries
Targeted regions
Associated malware (133)
CVEs seen in reporting
ATT&CK techniques in reports
- T1041 Exfiltration Over C2 Channel22
- T1071.001 Web Protocols21
- T1105 Ingress Tool Transfer20
- T1057 Process Discovery19
- T1547.001 Registry Run Keys / Startup Folder17
- T1027 Obfuscated Files or Information16
- T1082 System Information Discovery16
- T1204.002 Malicious File15
- T1083 File and Directory Discovery14
- T1036.005 Match Legitimate Resource Name or Location14
- T1005 Data from Local System14
- T1566.001 Spearphishing Attachment14
- T1070.004 File Deletion13
- T1140 Deobfuscate/Decode Files or Information13
- T1059.001 PowerShell12
- T1059 Command and Scripting Interpreter12
- T1049 System Network Connections Discovery12
- T1189 Drive-by Compromise12
- T1573.001 Symmetric Cryptography12
- T1055 Process Injection12
Also known as
Operation Troy, DEV-0139, Citrine Sleet, Bluenoroff, Nickel Academy, Group 77, G0032, BeagleBoyz, Stardust Chollima, Subgroup: Bluenoroff, G0082, Andariel, Operation GhostSecret, Bureau 121, APT 38, Sapphire Sleet, Unit 121, Dark Seoul, Whois Hacking Team, Operation DarkSeoul, Appleworm, Zinc, ATK3, Hastati Group, TA404, COPERNICIUM, Black Artemis, DEV-1222, Labyrinth Chollima, Hidden Cobra, ZINC, Moonstone Sleet, COVELLITE, Operation AppleJeus, NewRomanic Cyber Army Team, NICKEL GLADSTONE, ATK117, Diamond Sleet, APT38, APT-C-26