Threat actor · G0082

APT38

Also known as NICKEL GLADSTONE, BeagleBoyz, Bluenoroff, Stardust Chollima, Sapphire Sleet, COPERNICIUM.

APT38 is a North Korean state-sponsored threat group that specializes in financial cyber operations; it has been attributed to the Reconnaissance General Bureau. Active since at least 2014, APT38 has targeted banks, financial institutions, casinos, cryptocurrency exchanges, SWIFT system endpoints, and ATMs in at least 38 countries worldwide. Significant operations include the 2016 Bank of Bangladesh heist, Bancomext and Banco de Chile, along with software supply chain compromises and destructive malware attacks.

North Korean group definitions are known to have significant overlap, and some security researchers report all North Korean state-sponsored cyber activity under the name Lazarus Group instead of tracking clusters or subgroups.

ATT&CK techniques

115 mapped

T1005 T1012 T1027.002 T1027.010 T1027.015 T1027.016 T1033 T1036.003 T1036.005 T1036.006 T1036.008 T1041 T1048.002 T1049 T1053.003 T1053.005 T1053.006 T1055 T1056.001 T1056.002 T1057 T1059.001 T1059.002 T1059.003 T1059.004 T1059.005 T1059.006 T1059.007 T1070.003 T1070.004 T1070.006 T1071.001 T1074.001 T1078.003 T1078.004 T1082 T1083 T1105 T1106 T1110 T1112 T1115 T1124 T1132.001 T1135 T1140 T1189 T1195.001 T1204.001 T1204.002 T1213.005 T1213.006 T1217 T1218.001 T1218.005 T1218.007 T1218.011 T1222.002 T1480 T1480.002 T1485 T1486 T1505.003 T1518 T1518.001 T1529 T1543.001 T1543.003 T1543.004 T1546.016 T1547.001 T1548.002 T1548.003 T1548.006 T1552.003 T1552.004 T1553.005 T1555 T1555.001 T1555.003 T1560.001 T1561.002 T1564.003 T1564.011 T1564.012 T1565.001 T1565.002 T1565.003 T1566.001 T1566.002 T1566.003 T1567 T1569.002 T1571 T1583.001 T1583.003 T1583.006 T1585.001 T1585.002 T1586.003 T1588.002 T1608.001 T1620 T1657 T1677 T1678 T1683.001 T1683.002 T1684.001 T1685 T1685.003 T1685.005 T1686 T1686.002 T1690