Threat actor
Ruby Sleet
North Korea
Tracked by CyberSIXT since 9 Sep 2025
- Articles · all time
- 3
- Articles · last 30 days
- 0
- CVEs exploited · attributed · all time
- 0
- Research reports · all time
- 0
Names and sources
- Ruby Sleet
- Named by CyberSIXT coverage
- CERIUM
- Named by Malpedia · ruby_sleet
- Ruby Sleet
- Named by Malpedia · ruby_sleet
- CERIUM
- Named by Microsoft · Ruby Sleet
- Ruby Sleet
- Named by Microsoft · Ruby Sleet
- VELVET CHOLLIMA
- Named by Microsoft · Ruby Sleet
- CERIUM
- Named by MISP Galaxy · 03ff54cf-f7d4-4606-a531-2ca6d4fa6a54
- Ruby Sleet
- Named by MISP Galaxy · 03ff54cf-f7d4-4606-a531-2ca6d4fa6a54
All 10 names
- Velvet Chollima
- Named by CyberSIXT coverage
- 03ff54cf-f7d4-4606-a531-2ca6d4fa6a54
- Named by CyberSIXT coverage
Attributed facts
- category
- state (Microsoft · Ruby Sleet)
- origin
- North Korea (Microsoft · Ruby Sleet)
- origin
- North Korea (MISP Galaxy · 03ff54cf-f7d4-4606-a531-2ca6d4fa6a54)
- Kimsuky deploys HTTPSpy malware, expands toolkit for espionageThe Hacker News
- Kimsuky updates PebbleDash and AppleSeed with HelloDoor backdoorSecurelist
- APT37 Deploys New Rust and Python Malware Targeting Windows SystemsGBHackers · first in our coverage