APT38
Also tracked as NICKEL GLADSTONE, BeagleBoyz, Bluenoroff, Stardust Chollima, Sapphire Sleet, COPERNICIUM
APT38 is a North Korean state-sponsored threat group that specializes in financial cyber operations; it has been attributed to the Reconnaissance General Bureau. Active since at least 2014, APT38 has targeted banks, financial institutions, casinos, cryptocurrency exchanges, SWIFT system endpoints, and ATMs in at least 38 countries worldwide. Significant operations include the 2016 Bank of Bangladesh heist, during which APT38 stole $81 million, as well as attacks against Bancomext and Banco de Chile; some of their attacks have been destructive. North Korean group definitions are known to have significant overlap, and some security researchers report all North Korean state-sponsored cyber activity under the name Lazarus Group instead of tracking clusters or subgroups.
- Documented techniques
- 56
- Assessed origin
- North Korea
- Assessed motivation
- Sabotage
- First seen
- 2014
- Basis
- MITRE ATT&CK
How they break in
Techniques MITRE has documented this group using, grouped by the stage of an attack they belong to. This is the actionable half: each one is a behaviour you can look for in your own logs, and a control you can test.
resource development2
initial access2
execution9
persistence2
privilege escalation1
credential access1
discovery8
command and control2
impact7
defense impairment7
stealth12
- T1027.002 Software Packing
- T1036.003 Rename Legitimate Utilities
- T1036.006 Space after Filename
- T1055 Process Injection
- T1070.004 File Deletion
- T1070.006 Timestomp
- T1140 Deobfuscate/Decode Files or Information
- T1218.001 Compiled HTML File
- T1218.005 Mshta
- T1218.007 Msiexec
- T1218.011 Rundll32
- T1480.002 Mutual Exclusion
Malware
Families MITRE records this group deploying. Detection names for these are a reasonable place to start.
Tools
Legitimate or dual-use software the group is documented using. Most of it is software your own administrators use too, which is the point.