Threat actor
Andariel
North Korea
Tracked by CyberSIXT since 27 Feb
- Articlesall time
- 3
- Articleslast 30 days
- 0
- CVEs exploitedattributed · all time
- 0
- Research reportsall time
- 0
4 articles from 3 outlets since 24 Feb; the latest 49 days ago.
- Article
- First report
Show as table
| Published (UTC) | Outlet | Headline |
|---|---|---|
| Mon 7 Sep · 11:26 UTC | Infosecurity | Researchers Map Lazarus Into Six North Korean Cyber Units |
| Thu 7 May · 23:25 UTC | dti.domaintools.com | Fake Google Authenticator Chrome Extension Hits 260k Users |
| Fri 27 Feb · 10:22 UTC | SOCRadar | North Korea linked Andariel shifts to espionage and ransomware |
| Tue 24 Feb · 12:11 UTC | The Hacker News | Lazarus adopts Medusa RaaS to extort hospitals and charities |
Connections
25 tools- Malware and tools
- gh0st RAT, Rifdoor, Andardoor, Atharvan, BISTROMATH, Collection RAT, Dtrack, GopherRAT, JelusRAT, Jupiter
- Related actor
- Lazarus Group
Names and sources
13 names- Silent Chollima
- CyberSIXT coverage, Malpedia, Microsoft, MISP Galaxy, MITRE ATT&CK®
- Andariel
- Malpedia, Microsoft, MISP Galaxy, MITRE ATT&CK®
- GOP
- Malpedia, MISP Galaxy
- Guardian of Peace
- Malpedia, MISP Galaxy
- Onyx Sleet
- Malpedia, Microsoft, MISP Galaxy, MITRE ATT&CK®
- OperationTroy
- Malpedia, MISP Galaxy
- PLUTONIUM
- Malpedia, Microsoft, MISP Galaxy, MITRE ATT&CK®
- WHOis Team
- Malpedia, MISP Galaxy
5 more names
- APT45
- Microsoft
- Black Chollima
- Microsoft
- DarkSeoul
- Microsoft
- StoneFly
- Microsoft
- Tdrop2 campaign
- Microsoft
Attributed facts
- Origin
North Korea Microsoft · Onyx Sleet, MISP Galaxy
- Category
State Microsoft · Onyx Sleet
Malware and tools
MITRE ATT&CK® techniques
12 techniques · 8 tacticsFrom MITRE ATT&CK® · G0138
Values by tactic
Most recorded: Reconnaissance 2 · Initial Access 2 · Execution 2
Reconnaissance2
T1590.005IP AddressesT1592.002SoftwareResource Development1
T1588.001MalwareInitial Access2
T1189Drive-by CompromiseT1566.001Spearphishing AttachmentExecution2
T1203Exploitation for Client ExecutionT1204.002Malicious FileStealth1
T1027.003SteganographyDiscovery2
T1049System Network Connections DiscoveryT1057Process DiscoveryCollection1
T1005Data from Local SystemCommand and Control1
T1105Ingress Tool Transfer© 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. All techniques on MITRE ATT&CK
- Researchers Map Lazarus Into Six North Korean Cyber UnitsInfosecurity
- Fake Google Authenticator Chrome Extension Hits 260k Usersdti.domaintools.com
- North Korea linked Andariel shifts to espionage and ransomwareSOCRadar
- Lazarus adopts Medusa RaaS to extort hospitals and charitiesThe Hacker News · first in our coverage