APT38
Threat actorAttributed to North Korea by MITRE ATT&CK (source). An attribution, not a proven fact.
Names and who uses them
- APT38Our name
- BeagleBoyzCISA
- Stardust ChollimaCrowdStrike
- BluenoroffKaspersky
- COPERNICIUMMicrosoft
- Sapphire SleetMicrosoft
- NICKEL GLADSTONESecureworks
Targets
Sectors: Finance, Cryptocurrency
Source: MITRE ATT&CKKnown techniques
- T1005Data from Local System
- T1012Query Registry
- T1027.002Software Packing
- T1027.010Command Obfuscation
- T1027.015Compression
- T1027.016Junk Code Insertion
- T1033System Owner/User Discovery
- T1036.003Rename Legitimate Utilities
- T1036.005Match Legitimate Resource Name or Location
- T1036.006Space after Filename
- T1036.008Masquerade File Type
- T1041Exfiltration Over C2 Channel
- T1048.002Exfiltration Over Asymmetric Encrypted Non-C2 Protocol
- T1049System Network Connections Discovery
- T1053.003Cron
- T1053.005Scheduled Task
- T1053.006Systemd Timers
- T1055Process Injection
- T1056.001Keylogging
- T1056.002GUI Input Capture
- T1057Process Discovery
- T1059.001PowerShell
- T1059.002AppleScript
- T1059.003Windows Command Shell
- T1059.004Unix Shell
- T1059.005Visual Basic
- T1059.006Python
- T1059.007JavaScript
- T1070.003Clear Command History
- T1070.004File Deletion
- T1070.006Timestomp
- T1071.001Web Protocols
- T1074.001Local Data Staging
- T1078.003Local Accounts
- T1078.004Cloud Accounts
- T1082System Information Discovery
- T1083File and Directory Discovery
- T1105Ingress Tool Transfer
- T1106Native API
- T1110Brute Force
Malware and tools used
Source: MITRE ATT&CKRecent news
FBI attributes over $6 billion Binance crypto theft to North Korea's TraderTraitor
The FBI, with the US Secret Service and IRS-CI, attributes the theft of more than $6 billion from Binance on or about 29 October 2026 to North Korean group TraderTraitor. Attackers reached a service container through an engineer's laptop and sent unauthorised withdrawal requests, and Binance reports no private keys were stolen. Freezes by issuers and others covered only part of the funds, and the attacker still holds over 420,000 ETH and 18,270 BTC.