Andariel
Threat actorAttributed to North Korea by MITRE ATT&CK (source). An attribution, not a proven fact.
Names and who uses them
- AndarielOur name
- Silent ChollimaCrowdStrike
- Onyx SleetMicrosoft
- PLUTONIUMMicrosoft
Targets
Sectors: Government, Defence, Finance, Cryptocurrency
Regions: South Korea
Source: MITRE ATT&CKKnown techniques
- T1005Data from Local System
- T1027.003Steganography
- T1049System Network Connections Discovery
- T1057Process Discovery
- T1105Ingress Tool Transfer
- T1189Drive-by Compromise
- T1203Exploitation for Client Execution
- T1204.002Malicious File
- T1566.001Spearphishing Attachment
- T1588.001Malware
- T1590.005IP Addresses
- T1592.002Software
Malware and tools used
Source: MITRE ATT&CKRecent news
No stories yet.