Threat actors
Every actor CyberSIXT, MITRE ATT&CK and the MISP Galaxy know, reconciled. A row opens the actor's page when CyberSIXT covers it, its Atlas view otherwise.
| Actor | Origin | Motivation | CVEs | In KEV | Techniques | Software | Sources |
|---|---|---|---|---|---|---|---|
| KimsukyVelvet Chollima, Black Banshee, THALLIUM, Operation Stolen Pencil | North Korea | Espionage | 1 | 1 | 131 | 19 | CyberSIXT · ATT&CK G0094 · MISP Galaxy |
| Lazarus GroupLazarus, Operation DarkSeoul, Dark Seoul, Hidden Cobra | North Korea | Espionage, Destructive | 5 | 5 | 94 | 26 | CyberSIXT · ATT&CK G0032 · MISP Galaxy |
| APT37Group123, InkySquid, Operation Daybreak, Operation Erebus | North Korea | – | 6 | 5 | 29 | 13 | CyberSIXT · ATT&CK G0067 · MISP Galaxy |
| AndarielSilent Chollima, APT45, Onyx Sleet, StoneFly | North Korea | – | – | – | 12 | 2 | CyberSIXT · ATT&CK G0138 · MISP Galaxy |
| TA406TA406 is engaging in malware distribution, phishing, intelligence collection, and cryptocurrency theft, resulting in a wide range of criminal activities. | North Korea | – | – | – | – | – | CyberSIXT · MISP Galaxy |
| UNC4736AppleJeus, Gleaming Pisces, Citrine Sleet, UNC1720 | North Korea | – | 1 | 1 | 2 | – | CyberSIXT · ATT&CK G1049 · MISP Galaxy |
| OnionDogThis threat actor targets the South Korean government, transportation, and energy sectors. | North Korea | Espionage | – | – | – | – | MISP Galaxy |
| ChollimaAPT45, Silent Chollima (APT45), GRASS NEPTUNE | North Korea | – | – | – | – | – | CyberSIXT · MISP Galaxy |
| ELUSIVE COMETELUSIVE COMET is a threat actor responsible for significant cryptocurrency theft through sophisticated social engineering attacks, particularly leveraging Zoom's remote control feature. Their attack methodology involves | North Korea | – | – | – | – | – | MISP Galaxy |
| Famous ChollimaWageMole, UNC5267, Nickel Tapestry, Storm-1877 | North Korea | – | – | – | – | – | CyberSIXT · MISP Galaxy |
| Jasper SleetStorm-0287 | North Korea | – | – | – | – | – | CyberSIXT |
| Jinx-0164JINX-0164 is a financially motivated threat actor active since mid-2025, primarily targeting software developers through recruitment-themed social engineering to steal cryptocurrencies and conduct supply chain attacks. T | North Korea | – | – | – | – | – | CyberSIXT · MISP Galaxy |
| KonniOpal Sleet, OSMIUM, Vedalia, VELVET CHOLLIMA | North Korea | – | – | – | – | – | CyberSIXT · MISP Galaxy |
| Larva-24005Larva-24005 is a threat actor that breaches servers in Korea to establish a web server and PHP environment for phishing attacks, primarily targeting individuals involved with North Korea and university professors researc | North Korea | – | – | – | – | – | MISP Galaxy |
| Nickel AlleyNICKEL ALLEY is a North Korean threat group that targets technology professionals through fake job opportunities, employing social engineering tactics such as creating fraudulent LinkedIn pages and GitHub repositories fo | North Korea | – | – | – | – | – | MISP Galaxy |
| Pearl SleetDEV-0215, LAWRENCIUM | North Korea | – | – | – | – | – | CyberSIXT · MISP Galaxy |
| puNK-003puNK-003 is a North Korean APT group known for deploying the Lilith RAT, a sophisticated C++ remote access trojan, and its AutoIt variant, CURKON, which functions as a downloader. The group primarily distributes malware | North Korea | – | – | – | – | – | MISP Galaxy |
| Ruby SleetCERIUM, VELVET CHOLLIMA | North Korea | – | – | – | – | – | CyberSIXT · MISP Galaxy |
| Storm-0530DEV-0530, H0lyGh0st | North Korea | – | – | – | – | – | MISP Galaxy |
| TA444TA444 is a North Korea state-sponsored threat actor that primarily focuses on financially motivated operations. They have been active since at least 2017 and have recently shifted their attention to targeting cryptocurre | North Korea | – | – | – | – | – | MISP Galaxy |
| TEMP[.]HermitHERMIT NEPTUNE | North Korea | – | – | – | – | – | CyberSIXT · MISP Galaxy |
| TraderTraitorJade Sleet, UNC4899, Pukchong, Storm-0954 | North Korea | – | – | – | – | – | CyberSIXT · MISP Galaxy |
| UAT-5394UAT-5394 is a state-sponsored North Korean threat actor known for developing the MoonPeak RAT, which is based on XenoRAT. They have transitioned from using QuasarRAT to MoonPeak and have established command and control i | North Korea | – | – | – | – | – | MISP Galaxy |
| UNC1069MASAN, CryptoCore, MIDNIGHT NEPTUNE | North Korea | – | – | – | – | – | CyberSIXT · MISP Galaxy |
| UNC2970UNC2970 is a North Korean threat actor that primarily targets organizations through spear-phishing emails with job recruitment themes, often utilizing fake LinkedIn accounts to engage victims. The group employs the PLANK | North Korea | – | – | – | – | – | MISP Galaxy |
| UNC5342UNC5342 is a North Korea-linked APT that employs the EtherHiding technique to deliver malware and facilitate cryptocurrency theft. The actor has been observed deploying EtherRAT and JADESNOW malware, utilizing transactio | North Korea | – | – | – | – | – | CyberSIXT · MISP Galaxy |
| WassoniteWASSONITE is a North Korea-linked APT that has targeted industrial sectors, including electric generation, nuclear energy, manufacturing, and research entities in India, South Korea, and Japan since at least 2018. The gr | North Korea | – | – | – | – | – | MISP Galaxy |
ATT&CK © 2026 The MITRE Corporation, reproduced with its permission. MISP Galaxy under CC0. Every link between an actor and a CVE is a stored, sourced link. Data as of 2026-11-15.