Threat actor
Andariel
North Korea
Tracked by CyberSIXT since 27 Feb
- Articlesall time
- 3
- Articleslast 30 days
- 0
- CVEs exploitedattributed · all time
- 0
- Research reportsall time
- 0
) : ""}
Tactic coverageDistinct techniques recorded per ATT&CK tactic. The shape shows what the record covers, not activity or risk.
Names and sources
13 names- Silent Chollima
- CyberSIXT coverage, Malpedia, Microsoft, MISP Galaxy, MITRE ATT&CK®
- Andariel
- Malpedia, Microsoft, MISP Galaxy, MITRE ATT&CK®
- GOP
- Malpedia, MISP Galaxy
- Guardian of Peace
- Malpedia, MISP Galaxy
- Onyx Sleet
- Malpedia, Microsoft, MISP Galaxy, MITRE ATT&CK®
- OperationTroy
- Malpedia, MISP Galaxy
- PLUTONIUM
- Malpedia, Microsoft, MISP Galaxy, MITRE ATT&CK®
- WHOis Team
- Malpedia, MISP Galaxy
5 more names
- APT45
- Microsoft
- Black Chollima
- Microsoft
- DarkSeoul
- Microsoft
- StoneFly
- Microsoft
- Tdrop2 campaign
- Microsoft
Attributed facts
- Origin
North Korea Microsoft · Onyx Sleet, MISP Galaxy
- Category
State Microsoft · Onyx Sleet
Malware and tools
MITRE ATT&CK® techniques
12 techniques · 8 tacticsFrom MITRE ATT&CK® · G0138
Values by tactic
Most recorded: Reconnaissance 2 · Initial Access 2 · Execution 2
Reconnaissance2
T1590.005IP AddressesT1592.002SoftwareResource Development1
T1588.001MalwareInitial Access2
T1189Drive-by CompromiseT1566.001Spearphishing AttachmentExecution2
T1203Exploitation for Client ExecutionT1204.002Malicious FileStealth1
T1027.003SteganographyDiscovery2
T1049System Network Connections DiscoveryT1057Process DiscoveryCollection1
T1005Data from Local SystemCommand and Control1
T1105Ingress Tool Transfer© 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. All techniques on MITRE ATT&CK
- Researchers Map Lazarus Into Six North Korean Cyber UnitsInfosecurity
- Fake Google Authenticator Chrome Extension Hits 260k Usersdti.domaintools.com
- North Korea linked Andariel shifts to espionage and ransomwareSOCRadar · first in our coverage