STARDUST CHOLLIMA

▲ High Threat

Primary Aliases: APT38 APT45 Citrine Sleet DEV-0139

Confidence Rating 70% (Grounded)

Open-source reporting has claimed that the Hermes ransomware was developed by the North Korean group STARDUST CHOLLIMA (activities of which have been public reported as part of the “Lazarus Group”), because Hermes was executed on a host during the SWIFT compromise of FEIB in October 2017.

🎯 Target Sectors & Focus

Defense & Aerospace Government & Diplomacy Financial & Crypto Critical Infrastructure

🛡️ MITRE ATT&CK® Attack Lifecycle (56 TTPs)

📥 Download Navigator JSON

Initial Access 2

T1566 Drive-by Compromise

T1566 Spearphishing Attachment

Execution 4

T1059 Windows Command Shell

T1059 Scheduled Task

T1059 PowerShell

T1059 Service Execution

Persistence & Privilege Escalation 2

T1547 Modify Registry

T1547 Web Shell

Defense Evasion 2

T1027 Process Injection

T1027 Timestomp

Credential Access & Discovery 10

T1003 System Owner/User Discovery

T1003 System Network Connections Discovery

T1003 Keylogging

T1003 Security Software Discovery

T1003 File and Directory Discovery

T1003 Browser Information Discovery

T1003 Brute Force

T1003 Network Share Discovery

T1003 System Information Discovery

T1003 Process Discovery

Lateral Movement & Collection 1

T1021 Clipboard Data

Command & Control 2

T1071 Web Protocols

T1071 Ingress Tool Transfer

Exfiltration & Impact 2

T1485 Data Encrypted for Impact

T1485 Data Destruction

Operational Techniques 31

T1000 File Deletion

T1000 Space after Filename

T1000 Windows Service

T1000 Bypass User Account Control

T1000 Deobfuscate/Decode Files or Information

T1000 Visual Basic

T1000 System Shutdown/Reboot

T1000 Malicious Link

T1000 Disable or Modify Tools

T1000 Software Packing

T1000 Clear Windows Event Logs

T1000 Disable or Modify System Firewall

T1000 Mark-of-the-Web Bypass

T1000 Transmitted Data Manipulation

T1000 Network Device Firewall

T1000 Disk Structure Wipe

T1000 Rename Legitimate Utilities

T1000 Prevent Command History Logging

T1000 Runtime Data Manipulation

T1000 Native API

T1000 Compiled HTML File

T1000 Malicious File

T1000 Stored Data Manipulation

T1000 Data from Local System

T1000 Mutual Exclusion

Copied to clipboard

LINK COPIED TO CLIPBOARD