threat actor · North Korea
Ruby Sleet
On record in CyberSIXT · MISP Galaxy
Sources name this actor but link nothing to it yet: no CVE, technique or software is on record.
Open Ruby Sleet's actor pageRuby Sleet is a threat actor linked to North Korea's Ministry of State Security. Cerium has been involved in spear-phishing campaigns, compromising devices, and conducting cyberattacks alongside other North Korean threat actors. They have also targeted companies involved in COVID-19 research and vaccine development.
Source: MISP Galaxy. MISP Galaxy threat-actor cluster, by the MISP Project (CC0 1.0).
- Also known as
- CERIUM, VELVET CHOLLIMA
- Origin
- North Korea
- Kind
- state
- On record in
- CyberSIXT · MISP Galaxy
Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-14 · CISA KEV checked 2026-11-15. Sources: MITRE ATT&CK (© The MITRE Corporation, reproduced and distributed with its permission), the MISP Galaxy (CC0), and CyberSIXT's own coverage.