Quick links
Press Enter to search, Esc to close
Threat group profile
Attributed by the US, UK and South Korean governments to North Korea's Reconnaissance General Bureau, Andariel is described in a July 2024 joint advisory as stealing defense, aerospace and nuclear secrets and funding that work with ransomware against US healthcare.
In short
Attributed by the US, UK and South Korean governments to North Korea's Reconnaissance General Bureau, Andariel is described in a July 2024 joint advisory as stealing defense, aerospace and nuclear secrets and funding that work with ransomware against US healthcare. MITRE ATT&CK describes it as a sub-set of Lazarus Group; the advisory does not use that term.
Public reports use several names for this activity.
| Name | Where it appears |
|---|---|
| Silent Chollima | MITRE ATT&CK G0138 Associated Groups; AA24-207A; US indictment of 24 July 2024[1, 4, 6] |
| PLUTONIUM | MITRE ATT&CK G0138 Associated Groups; AA24-207A (as "formerly PLUTONIUM" for Onyx Sleet)[1, 4] |
| Onyx Sleet | MITRE ATT&CK G0138 Associated Groups; AA24-207A; US indictment of 24 July 2024[1, 4, 6] |
| DarkSeoul | AA24-207A (not on the MITRE Associated Groups list)[4] |
| Stonefly/Clasiopa | AA24-207A (not on the MITRE Associated Groups list)[4] |
Attribution is a judgment by the body named. It is shown here as attributed, not as proven fact.
MITRE ATT&CK Group page, version 2.0, modified 31 July 2026
Describes Andariel as a North Korean state-sponsored group active since at least 2009, attributed to the Reconnaissance General Bureau (RGB), and "considered a sub-set of Lazarus Group". Warns that North Korean group definitions overlap.[1]
US Treasury (OFAC) 13 September 2019
Named Lazarus Group, Bluenoroff and Andariel as controlled by the RGB, and called Andariel "the second Lazarus Group sub-group designated today".[7]
US Department of Justice 24 July 2024
The indictment of Rim Jong Hyok says a cyber unit within the RGB is known by researchers as Andariel, Onyx Sleet and Silent Chollima, and that he lived in North Korea and worked in RGB offices in Pyongyang and Sinuiju.[6]
FBI, CNMF, CISA, DC3, NSA, South Korea NIS and NPA, UK NCSC 25 July 2024
Joint advisory describes Andariel as a North Korean state-sponsored group under the RGB 3rd Bureau, based in Pyongyang and Sinuiju.[4]
UK NCSC 25 July 2024
Said it assesses that Andariel is part of the RGB 3rd Bureau and that its activity is an ongoing threat to critical infrastructure organizations.[5]
US State Department (Rewards for Justice) Undated page
Says the Andariel group is controlled by the RGB, and that Rim Jong Hyok is associated with it.[8]
US Treasury (OFAC) 8 July 2025
Sanctioned Song Kum Hyok as a cyber actor associated with the RGB hacking group Andariel, and repeated that Andariel was designated in 2019 as subordinate to the RGB.[9]
Sources differ on how Andariel relates to Lazarus Group. MITRE ATT&CK says Andariel "is considered a sub-set of Lazarus Group". The US Treasury on 13 September 2019 called it the second Lazarus Group sub-group designated that day, but on 8 July 2025 listed Lazarus Group, Bluenoroff and Andariel side by side as groups subordinate to the RGB. The joint advisory AA24-207A, the UK NCSC statement and the US indictment place Andariel under the RGB (the advisory says the 3rd Bureau) and do not mention Lazarus Group. MITRE also warns that North Korean group definitions overlap. Sources also differ on start dates: MITRE says active since at least 2009, while Treasury (2019) says cybersecurity firms first noticed Andariel around 2015. Names differ too: the advisory adds DarkSeoul and Stonefly/Clasiopa, which are not on the MITRE list.
Each entry is attributed to the group by the sources cited.
MITRE ATT&CK says the group has been active since at least 2009.[1]
Treasury (2019) says cybersecurity firms first noticed Andariel around 2015. Sources differ with MITRE on the start.[7]
The indictment says conspirators kept access for more than three months and extracted over seventeen gigabytes of unclassified data.[6]
The indictment lists an Arkansas company (7 March), a Connecticut company (11 March), a Florida hospital (15 March) and a Colorado clinic (24 March).[6]
The indictment says Log4Shell was used against Randolph and Robins Air Force Bases, and that over three terabytes were taken from an Oregon defense company.[6]
The indictment says files were encrypted in March 2023 and a payment of 4.3 Bitcoin was transferred on 12 April 2023.[6]
The indictment says over 250 gigabytes of stolen defense data from Taiwanese and South Korean companies were moved to one server.[6]
A grand jury in Kansas indicted Rim Jong Hyok.[6]
Indictments, sanctions and advisories that name the group or its alleged members.
| Date | Who | What |
|---|---|---|
| 13 September 2019 | US Department of the Treasury (OFAC) | SanctionsLazarus Group, Bluenoroff and Andariel identified as controlled entities of the North Korean government, based on their relationship to the RGB.[7] |
| 6 July 2022 (revised 7 July 2022) | FBI, CISA, US Treasury | Advisory AA22-187AMaui ransomware against healthcare. It does not name Andariel; the 2024 indictment cites it as covering this activity.[10, 6] |
| 9 February 2023 | NSA, FBI, CISA, HHS, South Korea NIS and DSA | Advisory AA23-040ADPRK ransomware funding advisory. It does not name Andariel; the 2024 indictment cites it as covering the funding of intrusions.[11, 6] |
| 24 July 2024 | US Department of Justice (District of Kansas grand jury) | IndictmentRim Jong Hyok charged with conspiracy over computer intrusion and extortion (18 U.S.C. 371) and conspiracy to commit money laundering (18 U.S.C. 1956(h)).[6] |
| 25 July 2024 | FBI, CNMF, CISA, DC3, NSA, South Korea NIS and NPA, UK NCSC | Joint advisory AA24-207AAdvisory on Andariel espionage and ransomware, with indicators and mitigations.[4, 5] |
| 6 August 2024 | Same authoring agencies | Advisory updateAA24-207A updated in the Credential Access and tools sections.[4] |
| 8 July 2025 | US Department of the Treasury (OFAC) | SanctionsSong Kum Hyok sanctioned as a cyber actor associated with Andariel, over an IT worker scheme.[9] |
| Undated | US State Department (Rewards for Justice) | Reward offerUp to 10 million dollars for information on Rim Jong Hyok and the Andariel group. AA24-207A repeats the offer.[8, 4] |
Techniques reported for this group, by MITRE ATT&CK tactic.
Exploit Public-Facing Application T1190
AA24-207A says the group exploits known flaws in web servers, such as Log4j, to deploy web shells. The indictment describes Log4Shell use against two Air Force bases.[4, 6]
Drive-by Compromise T1189
MITRE says the group has used watering hole attacks, often with zero-day exploits.[1]
Phishing: Spearphishing Attachment T1566.001
MITRE lists Word or Excel attachments. AA24-207A adds LNK and HTA files inside zip archives.[1, 4]
User Execution: Malicious File T1204.002
MITRE says it tried to lure victims into enabling macros in email attachments.[1]
Exploitation for Client Execution T1203
MITRE says it exploited many ActiveX vulnerabilities, including zero-days.[1]
Command and Scripting Interpreter T1059
AA24-207A says it uses Windows command line, PowerShell, WMIC and Linux bash, and prefers netstat commands.[4]
gh0st RAT Remote access tool
Rifdoor Remote access trojan
MITRE lists it for the group; MITRE says it shares code with another RAT.[1, 3]
Maui Ransomware
The indictment says conspirators used RGB-developed Maui ransomware against US hospitals and healthcare companies.[6]
TigerRAT Remote access tool
AA24-207A lists it among RATs developed by the group.[4]
MagicRAT Remote access tool
AA24-207A lists it among RATs developed by the group.[4]
YamaBot Remote access tool
AA24-207A lists it among RATs developed by the group.[4]
Valefor/VSingle Remote access tool
AA24-207A lists it among RATs developed by the group.[4]
NukeSped Remote access tool
AA24-207A lists it among RATs developed by the group.[4]
Mimikatz Credential theft tool
AA24-207A says the group uses it for privilege escalation.[4]
Also linked in our threat library:
Find systems that use Log4j and upgrade them. Keep an inventory of web-facing systems and apply patches quickly.
Counters T1190
Check web servers for web shells, using the NSA and Australian Signals Directorate guidance named in the advisory.
Counters T1190
Put risky systems behind reverse proxies that require authentication, use web application firewalls, and block outside access to admin panels.
Counters T1190
Change passwords whenever they may have been stolen.
Counters T1003
See which web servers and admin panels face the internet and which run flaws such as Log4j, the entry route the 2024 advisory describes.
Follow what governments and MITRE report on this group and check your controls against the listed techniques.
Follow ransomware activity against healthcare, which the 2024 advisory says this group uses to fund its espionage.
MITRE ATT&CK describes it as a North Korean state-sponsored group attributed to the Reconnaissance General Bureau (RGB). The 2024 joint advisory from the US, South Korea and the UK places it under the RGB 3rd Bureau.
The 2024 advisory says it mainly targets defense, aerospace, nuclear and engineering organizations, and medical and energy ones to a lesser extent. MITRE also lists South Korean government, military and companies.
The advisory says it exploits known flaws in web servers, such as Log4j, to install web shells. MITRE also lists watering hole attacks and spearphishing attachments.
Sources differ. MITRE says it is considered a sub-set of Lazarus Group, and Treasury in 2019 called it a Lazarus Group sub-group. The 2024 advisory places it under the RGB 3rd Bureau without mentioning Lazarus Group.
The US Justice Department indicted Rim Jong Hyok on 24 July 2024 over ransomware attacks on hospitals and intrusions into defense and government networks. The State Department offers up to 10 million dollars for information.
Patch Log4j and other internet-facing web servers, check them for web shells, and keep admin panels off the internet, as the 2024 advisory advises.
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.