Threat actor · MITRE ATT&CK G0138
Department of Peace
North Korea · also tracked as Silent Chollima, Andariel, GOP
Tracked by CyberSIXT since 27 Feb · RSS
8Articles, all time
5Articles, last 30 days
0CVEs exploited, attributed · all time
0Research reports, all time
Activity
Quiet for 2 dayslast report 30 Oct8 articles8 outlets
8 articles from 8 outlets since 27 Feb; 5 in the last 7 days.
- Fri 30 Oct. Malwarebytes. Hackers publish personal data on 41,000 DHS workers.
- Thu 29 Oct. DataBreaches. DHS personnel leak exposes details of more than 41,000 staff.
- Thu 29 Oct. Microsoft. Microsoft reports North Korean groups expanding AI operations.
- Thu 29 Oct. SecurityWeek. DHS Employee Data Leak Exposes Records of 41,000 People.
- Thu 29 Oct. Ars Technica. Leak exposes 41,000 DHS workers, including undercover ICE agents.
- Mon 7 Sep. Infosecurity. Researchers Map Lazarus Into Six North Korean Cyber Units.
- Thu 7 May. dti.domaintools.com. Fake Google Authenticator Chrome Extension Hits 260k Users.
- Fri 27 Feb. SOCRadar. North Korea linked Andariel shifts to espionage and ransomware.
- Article naming Department of Peace
- Articles a day, all coverage
- Quiet time, folded
Drawn: all 8 articles.
Show as tableHide table
| Date | Type | Source | Title |
|---|---|---|---|
| 30 Oct | Article | Malwarebytes | Hackers publish personal data on 41,000 DHS workers |
| 29 Oct | Article | DataBreaches | DHS personnel leak exposes details of more than 41,000 staff |
| 29 Oct | Article | Microsoft | Microsoft reports North Korean groups expanding AI operations |
| 29 Oct | Article | SecurityWeek | DHS Employee Data Leak Exposes Records of 41,000 People |
| 29 Oct | Article | Ars Technica | Leak exposes 41,000 DHS workers, including undercover ICE agents |
| 7 Sep | Article | Infosecurity | Researchers Map Lazarus Into Six North Korean Cyber Units |
| 7 May | Article | dti.domaintools.com | Fake Google Authenticator Chrome Extension Hits 260k Users |
| 27 Feb | Article | SOCRadar | North Korea linked Andariel shifts to espionage and ransomware |
Connections
25 tools. What the record links this actor to; hover or use the arrow keys.
Show as a listHide the list
- Malware and tools
- gh0st RAT, Rifdoor, Andardoor, Atharvan, BISTROMATH, Collection RAT, Dtrack, GopherRAT, JelusRAT, Jupiter
- Related actor
- Lazarus Group
CVEs exploited
No CVE is attributed to Department of Peace in CyberSIXT coverage.
MITRE ATT&CK techniques12 techniques · 8 tactics
Distinct techniques recorded per ATT&CK tactic. The shape shows what the record covers, not activity or risk.
Compare withFamous Chollima
Show as tableHide table
| Tactic | Department of Peace | Average of 48 actors |
|---|---|---|
| Reconnaissance | 2 | 2.2 |
| Resource Development | 1 | 4.9 |
| Initial Access | 2 | 3.3 |
| Execution | 2 | 5.7 |
| Persistence | 0 | 4.4 |
| Privilege Escalation | 0 | 3.7 |
| Stealth | 1 | 7.9 |
| Defense Impairment | 0 | 1.5 |
| Credential Access | 0 | 3.1 |
| Discovery | 2 | 5.9 |
| Lateral Movement | 0 | 1.5 |
| Collection | 1 | 3.1 |
| Command and Control | 1 | 4 |
| Exfiltration | 0 | 0.9 |
| Impact | 0 | 1.1 |
Most recorded: Reconnaissance 2 · Initial Access 2 · Execution 2
Show the technique matrixTechnique matrix12 techniques
Reconnaissance2
Resource Development1
Initial Access2
Execution2
Stealth1
Discovery2
Collection1
Command and Control1
© 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. All techniques on MITRE ATT&CK
Malware and tools25
MITRE ATT&CK® · G0138 and Malpedia · silent_chollima
Articles8
Drawn: all 8 articles.
- Fake Google Authenticator Chrome Extension Hits 260k Usersdti.domaintools.com