FlagThis

← All Threat Actors
Threat Actor Profile

Andariel

G0138 Onyx Sleet PLUTONIUM Silent Chollima
⚠ Critical Threat
Targeted Defense Industry Espionage, Semiconductor IP Theft Operations, Cryptocurrency Asset Exfiltration
Origin North Korea (DPRK)
Sponsor Democratic People's Republic of Korea (DPRK) - Reconnaissance General Bureau (RGB)
Motivation Military espionage, intellectual property theft, and regime financing through cryptocurrency theft.

Target Sectors

Defense Industrial Base Aerospace and Aviation Semiconductor Industry Biotechnology Government Agencies Cryptocurrency Exchanges and DeFi Protocols South Korean Defense Contractors

Known TTPs

Spear-phishing with malicious attachments
Exploitation of public-facing vulnerabilities (CVEs)
Custom malware deployment (Backdoors, RATs, Info-stealers)
Credential harvesting via fake login pages
Supply chain compromise
Lateral movement via SMB and WMI
Data exfiltration via encrypted C2 channels

External Resources

CISA Advisories ↗

Related Intelligence

Hacking the mainframe…
LINK COPIED TO CLIPBOARD