Log in Request a demo

Threat group profile

APT38

Also known as Bluenoroff, Stardust Chollima, BeagleBoyz

APT38 is a North Korean state-sponsored group focused on financial theft, attributed by MITRE ATT&CK to North Korea's Reconnaissance General Bureau.

In short

APT38 is a North Korean state-sponsored group focused on financial theft, attributed by MITRE ATT&CK to North Korea's Reconnaissance General Bureau. MITRE lists banks, cryptocurrency exchanges and SWIFT system endpoints among its targets. The US Department of Justice named APT38 in November 2025 forfeiture cases over four 2023 cryptocurrency heists.

Last updated 9 October 2026

Profile MapThreat Group
  1. Attributed OriginNorth Korea
  2. Names9names in public reportsAPT38 · BeagleBoyz · Bluenoroff
  3. Sectors6named as targetsBank payment systems and ATMs · SWIFT endpoints · Cryptocurrency exchanges
  4. Techniques14in the attack chainInitial Access · Resource Development · Execution
  5. Tools11tools and malware listedDYEPACK · FASTCash · HOPLIGHT

In one minute

Who they are
MITRE ATT&CK describes APT38 as a North Korean state-sponsored group that specializes in financial cyber operations, attributed to the Reconnaissance General Bureau. The US Treasury sanctioned Bluenoroff in 2019 and lists APT38 as an alias, and the US Department of Justice named APT38 in November 2025. Sources differ on how it relates to Lazarus Group.
Who they target
MITRE lists banks, financial institutions, casinos, cryptocurrency exchanges, SWIFT system endpoints and ATMs. The 2020 advisory lists financial institutions in dozens of countries, and the Department of Justice cites four cryptocurrency platform heists in 2023.
How they usually get in
The 2020 advisory lists spearphishing, watering holes, internet-facing flaws and stolen credentials. The 2022 advisory, which ties its group to the same names, describes recruitment-style messages and fake trading apps.
What stands out
The activity described is money theft: forged SWIFT transfers, fake approvals of ATM cash-outs and cryptocurrency heists. MITRE and the 2020 advisory also list destructive tools such as disk wipers.
What to do first
If you run payment systems, isolate the payment switch and SWIFT-connected systems, require multi-factor authentication to reach them and watch transactions against a baseline. If you hold cryptocurrency, check job and investment offers on a separate channel and never run test code on company devices.

Names

Public reports use several names for this activity.

Names used for APT38
NameWhere it appears
APT38 MITRE ATT&CK group name; US Department of Justice release of 14 November 2025; alias on the US sanctions list[1, 4, 11]
BeagleBoyz MITRE ATT&CK Associated Groups; the US Government name used in the 2020 FASTCash 2.0 advisory[1, 6]
Bluenoroff MITRE ATT&CK Associated Groups; US Treasury release of 13 September 2019; US sanctions list entry[1, 3, 4]
Stardust Chollima MITRE ATT&CK Associated Groups; alias on the US sanctions list; 2022 TraderTraitor advisory[1, 4, 8]
NICKEL GLADSTONE MITRE ATT&CK Associated Groups[1]
Sapphire Sleet MITRE ATT&CK Associated Groups[1]
COPERNICIUM MITRE ATT&CK Associated Groups[1]
APT 38 Alias, written with a space, on the US sanctions list entry for BLUENOROFF[4]
Lazarus Group Not on MITRE's APT38 alias list. Named in the 2020 and 2022 advisories as a name that overlaps with or is commonly used for this activity; see Related groups[1, 6, 8]

Who says so

Attribution is a judgment by the body named. It is shown here as attributed, not as proven fact.

  • MITRE ATT&CK Page version 3.1, modified 31 July 2026

    Describes APT38 as a North Korean state-sponsored threat group that specializes in financial cyber operations, attributed to the Reconnaissance General Bureau, active since at least 2014.[1]

  • MITRE ATT&CK (Lazarus Group page) Page modified 31 July 2026

    Says public reporting often uses "Lazarus Group" as an umbrella term for multiple North Korean cyber operators. Its alias list for Lazarus Group does not include APT38 or Bluenoroff.[2]

  • DHS, Treasury and FBI 2 October 2018 (revised 21 December 2018)

    Attributed the FASTCash ATM cash-out scheme to HIDDEN COBRA actors, the US Government name for malicious cyber activity by the North Korean government. The alert does not use the name APT38.[5, 14]

  • US Department of the Treasury 13 September 2019

    Designated Lazarus Group, Bluenoroff and Andariel as controlled by the Reconnaissance General Bureau. It called Bluenoroff one of two sub-groups of Lazarus Group and said Bluenoroff conducts cyber-enabled heists against foreign financial institutions.[3]

  • US Treasury, Office of Foreign Assets Control 13 May 2020

    Sanctions list entry for BLUENOROFF with the aliases APT 38, APT38 and STARDUST CHOLLIMA. The Lazarus Group entry on the same list is separate.[4]

  • CISA, Treasury, FBI and US Cyber Command 26 August 2020

    Said North Korea's intelligence apparatus controls a bank-robbing team that the US Government calls BeagleBoyz, described as an element of the Reconnaissance General Bureau. They said it overlaps to varying degrees with groups tracked as Lazarus, APT38, Bluenoroff and Stardust Chollima.[6]

  • FBI, CISA and Treasury 17 February 2021

    Assessed that Lazarus Group, which these agencies attribute to North Korean state-sponsored actors, targets cryptocurrency firms with modified trading applications (AppleJeus). The advisory does not name APT38.[7, 14]

  • FBI, CISA and Treasury 18 April 2022

    Said a North Korean state-sponsored group active since at least 2020 is commonly tracked as Lazarus Group, APT38, BlueNoroff and Stardust Chollima, and described its cryptocurrency-industry intrusions.[8, 14]

  • FBI February 2025 (notice ID PSA250226)

    Said North Korea was responsible for the theft of about $1.5 billion in virtual assets from the exchange Bybit and called the activity TraderTraitor. The notice does not use the name APT38.[10]

  • US Department of Justice 14 November 2025

    Described APT38 as a North Korean military hacking group known to the private sector, and said it carried out virtual currency heists at four overseas platforms in 2023.[11]

Where sources differ

Sources differ on how APT38 relates to Lazarus Group. The US Treasury (13 September 2019) calls Bluenoroff one of two sub-groups of Lazarus Group, the US sanctions list (13 May 2020) holds Bluenoroff and Lazarus Group as separate entries with APT38 only an alias of Bluenoroff, and MITRE ATT&CK keeps two pages and says North Korean group definitions are known to have significant overlap. The 2020 FASTCash 2.0 advisory says the BeagleBoyz overlap to varying degrees with groups tracked as Lazarus, APT38, Bluenoroff and Stardust Chollima, and the 2022 TraderTraitor advisory says one group is commonly tracked under all four names while also referring to Lazarus Group actors.

The 2021 AppleJeus advisory and the 2024 and 2025 FBI notices do not name APT38, and only the US Department of Justice release of 14 November 2025 uses APT38 on its own, as a North Korean military hacking group. Figures also differ for the 2016 Bangladesh theft: MITRE and the 2020 advisory say $81 million was stolen, and Treasury says approximately $80 million. Treasury gives the attempted total as $851 million and the 2020 advisory gives $1 billion.

Who they target

Sectors

  • Banks and financial institutionsMITRE lists banks and financial institutions. The 2020 advisory says the BeagleBoyz likely targeted financial institutions in nations including Argentina, Bangladesh, Chile, India, Mexico, Vietnam and South Africa from 2015 through 2020.[1, 6]
  • Bank payment systems and ATMsMITRE lists ATMs. The 2018 alert and 2020 advisory describe attacks on bank payment switch servers to approve fraudulent ATM withdrawals, with one 2017 incident reaching ATMs in over 30 countries. The 2020 advisory adds at least two regional interbank payment processors.[1, 5, 6]
  • SWIFT endpointsMITRE lists SWIFT system endpoints. The 2020 advisory says the BeagleBoyz seek the SWIFT terminal (SWIFT is the bank payment messaging system) and have abused compromised endpoints since at least 2015.[1, 6]
  • Cryptocurrency exchangesMITRE lists cryptocurrency exchanges. The Department of Justice (2025) describes heists at overseas virtual currency platforms in 2023.[1, 11]
  • Cryptocurrency and blockchain firmsThe 2022 advisory lists exchanges, DeFi protocols, play-to-earn games, trading companies, venture capital funds investing in cryptocurrency and large individual holders.[8]
  • CasinosMITRE lists casinos among the targets of APT38.[1]

Regions

  • BangladeshMITRE and the 2020 advisory name the 2016 Bank of Bangladesh theft of $81 million.[1, 6]
  • Chile and MexicoMITRE names attacks on Banco de Chile and Bancomext. The 2020 advisory says a wiper was used against a bank in Chile in 2018.[1, 6]
  • AfricaThe 2018 alert says FASTCash targeted banks in Africa and Asia since at least late 2016. The 2020 advisory says a bank in Africa could not resume ATM or point of sale services for almost two months in 2018.[5, 6]
  • Estonia, Panama and SeychellesThe Department of Justice (2025) names platforms based in these countries in the four 2023 heists.[11]
  • United StatesThe 2020 advisory says the BeagleBoyz used unwitting banks, including US banks, as custodians or pass-through points for SWIFT fraud, and that cash was withdrawn at ATMs including in the United States.[6]
  • TürkiyeThe 2020 advisory lists Turkey among the nations the BeagleBoyz likely targeted from 2015 through 2020.[6]
  • PakistanThe advisory says the North Korean BeagleBoyz, which overlap to varying degrees with APT38, likely targeted financial institutions in a list of nations from 2015 through 2020, including Pakistan.[6]
  • IndonesiaNames Indonesia in a list of nations whose financial institutions the North Korean BeagleBoyz team likely targeted from 2015 through 2020. The advisory says the team overlaps with APT38 to varying degrees.[6]
  • IndiaNames India in a list of nations whose financial institutions the North Korean BeagleBoyz team likely targeted from 2015 through 2020. The advisory says the team overlaps with APT38 to varying degrees.[6]
  • SingaporeThe advisory says the BeagleBoyz likely targeted financial institutions in a list of nations since 2015, and Singapore is on the list. It says they overlap to varying degrees with APT38.[6]
  • South KoreaThe advisory says the North Korean group it calls the BeagleBoyz likely targeted financial institutions in a list of nations from 2015 through 2020. South Korea is on the list. It says the group overlaps with groups known as APT38 and Lazarus Group.[6]
  • NigeriaThe advisory says the North Korean BeagleBoyz, which overlap with groups tracked as APT38 and Lazarus, likely targeted financial institutions in a list of nations from 2015 through 2020, and Nigeria is on that list.[6]

Operations timeline

Each entry is attributed to the group by the sources cited.

  1. At least 2014

    Earliest activity reported

    MITRE says APT38 has been active since at least 2014. The 2020 advisory says the BeagleBoyz have likely been active since at least 2014.[1, 6]

  2. At least 2015

    SWIFT endpoint abuse

    The 2020 advisory attributes fraudulent abuse of compromised bank-operated SWIFT system endpoints since at least 2015 to the BeagleBoyz.[6]

  3. At least late 2016

    FASTCash against banks

    The 2018 alert says HIDDEN COBRA actors used FASTCash tactics since at least late 2016 to target banks in Africa and Asia. The 2020 advisory ties FASTCash to the BeagleBoyz.[5, 6]

  4. 2016

    Bank of Bangladesh theft

    MITRE says APT38 stole $81 million. The 2020 advisory says the New York Federal Reserve stopped the rest of an attempted $1 billion theft. Treasury (2019) says Bluenoroff worked jointly with Lazarus Group on this theft.[1, 3, 6]

  5. 2017

    Cash-out in over 30 countries

    The 2018 alert says that in one 2017 incident HIDDEN COBRA actors enabled cash to be withdrawn from ATMs in over 30 countries at the same time.[5]

  6. 2018

    Wiper attack on a Chilean bank

    The 2020 advisory says wiper malware crashed thousands of computers and servers at a bank in Chile to distract from fraudulent messages sent from its SWIFT terminal. MITRE names Banco de Chile.[1, 6]

  7. End of 2018 to early 2020

    Job-themed phishing

    The 2020 advisory says the BeagleBoyz used job-application themed phishing attacks.[6]

  8. February 2020

    Bank targeting resumes

    The 2020 advisory says North Korea resumed targeting banks in multiple countries after a lull since late 2019.[6]

  9. At least 2020

    Cryptocurrency industry intrusions

    The 2022 advisory describes a North Korean state-sponsored group active since at least 2020 that sends recruitment-style spearphishing to staff of cryptocurrency firms.[8]

  10. 2023

    Four cryptocurrency platform heists

    The Department of Justice (2025) lists July 2023 thefts of about $37 million and $100 million, and November 2023 thefts of about $138 million and $107 million.[11]

  11. March 2025

    FBI seizure

    The Department of Justice says the FBI seized USDT stablecoin from North Korean APT38 actors in March 2025.[11]

  12. 14 November 2025

    Forfeiture complaints announced

    The Department of Justice says it seeks to forfeit more than $15 million and that APT38 actors continue to launder stolen funds.[11]

Government actions

Indictments, sanctions and advisories that name the group or its alleged members.

Government actions about APT38
DateWhoWhat
2 October 2018 DHS, Treasury and FBI Technical alertPublished the FASTCash alert (TA18-275A) on ATM cash-out attacks on bank payment switch servers, attributed to HIDDEN COBRA actors, with mitigations.[5, 14]
13 September 2019 US Department of the Treasury SanctionsDesignated Lazarus Group, Bluenoroff and Andariel as controlled by the Reconnaissance General Bureau under Executive Order 13722.[3]
13 May 2020 US Treasury, Office of Foreign Assets Control Sanctions list updateList entry for BLUENOROFF shows APT 38, APT38 and STARDUST CHOLLIMA as aliases.[4]
26 August 2020 CISA, Treasury, FBI and US Cyber Command Joint advisoryPublished FASTCash 2.0 (AA20-239A) on the BeagleBoyz bank-robbing scheme, with malware reports and mitigations.[6, 14]
17 February 2021 FBI, CISA and Treasury Joint advisoryPublished the AppleJeus advisory (AA21-048A), which attributes the activity to Lazarus Group and does not name APT38.[7, 14]
18 April 2022 FBI, CISA and Treasury Joint advisoryPublished the TraderTraitor advisory (AA22-108A) on a group commonly tracked as Lazarus Group, APT38, BlueNoroff and Stardust Chollima.[8, 14]
September 2024 FBI Public service announcementWarned cryptocurrency firms about North Korean social engineering with fake job and investment offers. The notice does not name APT38.[9]
February 2025 FBI Public service announcementSaid North Korea was responsible for the $1.5 billion Bybit theft, called the activity TraderTraitor, and asked firms to block listed addresses. The notice does not name APT38.[10]
March 2025 FBI SeizureSeized USDT stablecoin from North Korean APT38 actors, per the Department of Justice.[11]
24 October 2025 US Department of Justice Civil forfeiture complaintFiled a complaint to forfeit 1,159,834.52 USDT linked to APT38 actors.[11]
14 November 2025 US Department of Justice Civil forfeiture complaintFiled a second complaint to forfeit 13,980,951.103 USDT, bringing the total to more than $15 million.[11]

How they get in

Techniques reported for this group, by MITRE ATT&CK tactic.

Resource Development

  • Acquire Infrastructure: Domains T1583.001

    Creates fake domains that imitate legitimate venture capital or bank domains.[1]

Initial Access

  • Phishing: Spearphishing Attachment T1566.001

    Sends emails with malicious attachments; the 2020 advisory describes job-application themed lures.[1, 6]

  • Drive-by Compromise T1189

    Uses watering hole attacks, where a website its victims visit is compromised, to gain first access.[1, 6]

  • Valid Accounts T1078

    The 2020 advisory lists stolen credentials of a specific user or service account as a way in and a way to keep access.[6]

Execution

  • User Execution: Malicious File T1204.002

    Tries to get victims to enable macros in email attachments and has used malicious Word documents and shortcut files.[1]

  • Command and Scripting Interpreter: PowerShell T1059.001

    Uses PowerShell to run commands and routine tasks.[1, 6]

Persistence

  • Server Software Component: Web Shell T1505.003

    Uses web shells to keep access or add a second way in.[1, 6]

Defense Evasion

  • Subvert Trust Controls: Mark-of-the-Web Bypass T1553.005

    Uses ISO and VHD files to deliver malware and avoid the Mark-of-the-Web security warning.[1]

  • Indicator Removal: File Deletion T1070.004

    Deletes its tools and other files after use to reduce its footprint, including with a secure delete utility.[1, 6]

Credential Access

  • Brute Force T1110

    Tries to guess account access when passwords or password hashes are not available.[1, 6]

Command and Control

  • Application Layer Protocol: Web Protocols T1071.001

    A backdoor named QUICKRIDE talks to its control server over HTTP and HTTPS.[1]

Impact

  • Data Manipulation: Stored Data Manipulation T1565.001

    Uses DYEPACK to create, delete and alter records in databases used for SWIFT transactions.[1, 6]

  • Disk Wipe: Disk Structure Wipe T1561.002

    Uses a custom wiper named BOOTWRECK to overwrite the master boot record and make systems unusable.[1, 6]

  • Data Encrypted for Impact T1486

    MITRE says APT38 used Hermes ransomware to encrypt files.[1]

Tools and malware

  • DYEPACK SWIFT manipulation tool

    MITRE says APT38 used it to alter records in SWIFT transaction databases and SWIFT messages on their way to a printer.[1]

  • FASTCash ATM cash-out malware

    CISA says it intercepts bank payment request messages and replies with fake approvals, with versions for UNIX (AIX) and Windows servers.[5, 6]

  • HOPLIGHT Backdoor

    The 2020 advisory says it has the same basic remote access functions as CROWDEDFLOUNDER; MITRE lists it as used by APT38.[1, 6, 13]

  • CROWDEDFLOUNDER Remote access trojan

    The 2020 advisory says the BeagleBoyz used it as a remote access trojan on Windows hosts since at least 2018.[6]

  • ECCENTRICBANDWAGON Remote access trojan

    MITRE says it is a reconnaissance tool with keylogging and screen capture; the 2020 advisory lists it among BeagleBoyz tools.[1, 6, 12]

  • COPPERHEDGE Remote access tool

    The 2020 advisory names it as the tool of choice for the BeagleBoyz to attack cryptocurrency exchanges.[6]

  • ELECTRICFISH and VIVACIOUSGIFT Network proxy tools

    The 2020 advisory says they tunnel traffic from non-internet facing systems such as an ATM switch server or a SWIFT terminal out to the internet.[6]

  • BOOTWRECK Disk wiper

    MITRE says APT38 used this custom wiper on the master boot record, which then reboots the system.[1]

  • Hermes Ransomware

    MITRE says APT38 used Hermes ransomware to encrypt files with AES256.[1]

  • Mimikatz Open-source credential tool

    MITRE says APT38 obtained and used open-source tools such as Mimikatz.[1]

  • Manuscrypt Remote access trojan

    The 2022 advisory lists Manuscrypt among payloads dropped by fake cryptocurrency trading apps in the activity it ties to a group commonly tracked as APT38 and other names.[8]

Detection and defense

  1. Isolate payment systems

    Keep payment switch and SWIFT-connected systems apart from the rest of the network, divide the environment into enclaves with firewalls and access control lists, and require multi-factor authentication to reach the switch server.

    Counters T1078 T1565.001

  2. Monitor transactions and servers

    Log switch server transactions and set a baseline of expected software, users, logons, transaction participants, amounts, frequency and timing, then flag anything outside it.

    Counters T1565.001 T1070.004

  3. Validate payment messages

    Require chip and PIN cryptogram validation and message authentication codes on issuer responses, so forged approvals are rejected.

    Counters T1565.001

  4. Harden email

    Train staff to spot social engineering, scan attachments, disable macros that come from outside the organization, and watch or block newly registered domains.

    Counters T1566.001 T1204.002 T1583.001

  5. Allow only approved programs

    Use application allowlisting so only approved programs run, which the 2022 advisory says can stop the first attack even if a user opens a malicious file.

    Counters T1204.002 T1059.001 T1553.005

  6. Check recruiters and downloads

    Verify unexpected job or investment offers on a separate channel, never run pre-employment test code on company devices, and take cryptocurrency apps only from primary sources.

    Counters T1566.001 T1204.002

  7. Protect wallets and approvals

    Do not keep wallet keys or seed phrases on internet-connected devices, and require several approvals across separate networks before funds move.

    Counters T1078 T1110

  8. Patch and segment

    Patch known exploited flaws first, prioritize internet-facing devices, segment networks to limit lateral movement and use multi-factor authentication.

    Counters T1189 T1505.003 T1110

What Brandefense can do

  • Cyber Threat Intelligence

    Follow government and MITRE reporting on APT38 and the related North Korean names, and compare the listed techniques with your own controls.

  • Dark Web Monitoring

    See whether staff or customer credentials are offered for sale, since the advisories list stolen credentials among the ways in.

  • Phishing Monitoring & Domain Abuse

    Spot fake domains that imitate banks or venture capital firms and sites that push fake trading apps, as MITRE and the 2022 advisory describe.

  • Executive Protection

    Find fake profiles that impersonate your leaders or recruiters, a lure the FBI describes in its 2024 notice.

Questions

Who is APT38?

MITRE ATT&CK describes it as a North Korean state-sponsored group that specializes in financial cyber operations and has been attributed to the Reconnaissance General Bureau. The US Treasury and US Department of Justice use the names Bluenoroff and APT38.

Is APT38 the same as Lazarus Group?

Sources differ. Treasury (2019) called Bluenoroff a sub-group of Lazarus Group, the US sanctions list keeps them as separate entries, and MITRE keeps two pages and says North Korean group definitions overlap significantly.

What does it target?

MITRE lists banks, financial institutions, casinos, cryptocurrency exchanges, SWIFT system endpoints and ATMs. The 2022 advisory adds DeFi protocols, crypto games and venture funds.

How do they get in?

The 2020 advisory lists spearphishing, watering holes, internet-facing flaws, stolen credentials and trusted relationships. The 2022 advisory describes recruitment-style messages that lead staff to download fake trading apps.

Is APT38 still active?

On 14 November 2025 the US Department of Justice said APT38 actors carried out four heists in 2023 and continue to launder the funds, and that the FBI seized funds in March 2025.

What should a bank do first?

The 2020 advisory advises isolating payment system infrastructure, requiring multi-factor authentication to reach the switch server, and monitoring transactions against a baseline.

In our research

  1. TraderTraitor: North Korea’s Crypto Heist Machine December 2025
  2. Geopolitical Countdown: The Evolution of Cyberspace from Espionage to Destruction and New Strategies for Corporate Resilience November 2025
  3. Leaked Credentials from Ransomware Groups: Case Insights October 2025
  4. The Lazarus Group: Espionage, Sabotage, and Cybercrime Under One Umbrella October 2025
  5. APT38: From SWIFT Heists to Crypto Fortresses September 2025
  6. Perspective of the Month | APT Groups May 2023
  7. European Focused Threat Actors – APT Groups September 2022
  8. Lazarus APT Group (APT38) August 2022

Sources

  1. APT38, Group G0082 MITRE ATT&CK Supports: Aliases, description, active since 2014, techniques, software, note on overlap with Lazarus Group
  2. Lazarus Group, Group G0032 MITRE ATT&CK Supports: MITRE's separate Lazarus Group page, its alias list and the umbrella-term remark
  3. Treasury Sanctions North Korean State-Sponsored Malicious Cyber Groups US Department of the Treasury Supports: 13 September 2019 designation of Lazarus Group, Bluenoroff and Andariel; Bluenoroff called a sub-group of Lazarus Group
  4. North Korea Administrative Designations Updates US Department of the Treasury, Office of Foreign Assets Control Supports: 13 May 2020 sanctions list entry for BLUENOROFF with APT 38, APT38 and STARDUST CHOLLIMA as aliases
  5. HIDDEN COBRA: FASTCash Campaign (TA18-275A) DHS, Treasury and FBI, via CISA Supports: FASTCash ATM cash-out scheme, attributed to HIDDEN COBRA actors, and its mitigations
  6. FASTCash 2.0: North Korea's BeagleBoyz Robbing Banks (AA20-239A) CISA, Treasury, FBI and US Cyber Command Supports: BeagleBoyz profile, overlap with APT38, targets, techniques, tools and mitigations
  7. AppleJeus: Analysis of North Korea's Cryptocurrency Malware (AA21-048A) FBI, CISA and Treasury, via CISA Supports: Attributes AppleJeus to Lazarus Group and does not name APT38
  8. TraderTraitor: North Korean State-Sponsored APT Targets Blockchain Companies (AA22-108A) FBI, CISA and Treasury, via CISA Supports: Group commonly tracked as Lazarus Group, APT38, BlueNoroff and Stardust Chollima; cryptocurrency targets, entry and mitigations
  9. North Korea Aggressively Targeting Crypto Industry with Well-Disguised Social Engineering Attacks FBI Internet Crime Complaint Center Supports: Social engineering tactics and mitigations for cryptocurrency firms; does not name APT38
  10. North Korea Responsible for $1.5 Billion Bybit Hack FBI Internet Crime Complaint Center Supports: FBI attributes the Bybit theft to North Korea and calls the activity TraderTraitor; does not name APT38
  11. Justice Department Announces Nationwide Actions to Combat Illicit North Korean Government Revenue Generation US Department of Justice Supports: 14 November 2025 forfeiture complaints naming APT38 and four 2023 cryptocurrency heists
  12. ECCENTRICBANDWAGON, Software S0593 MITRE ATT&CK Supports: Description of the remote access Trojan
  13. HOPLIGHT, Software S0376 MITRE ATT&CK Supports: Description of the backdoor
  14. North Korea State-Sponsored Cyber Threat: Advisories CISA Supports: Publication dates of the FASTCash, FASTCash 2.0, AppleJeus and TraderTraitor products

Other groups

All groups

Andariel

Attributed by the US, UK and South Korean governments to North Korea's Reconnaissance General Bureau, Andariel is described in a July 2024 joint advisory as stealing defense, aerospace and nuclear secrets and funding that work with ransomware against US healthcare. MITRE ATT&CK describes it as a sub-set of Lazarus Group; the advisory does not use that term.

Attributed by the US, UK and South Korean governments, and MITRE ATT&CK

  • KPAttributed to North Korea
Active since 2009 Full profile

APT-C-60

APT-C-60 is the name JPCERT/CC uses for a threat group it says likely carried out spear-phishing attacks on organizations in Japan from August 2024, using fake job-applicant emails and a backdoor called SpyGlace. No government or MITRE source opened for this page says who is behind it.

Short profile

APT1

Also known as Comment Crew · Comment Panda · Comment Group

Attributed by MITRE ATT&CK to PLA Unit 61398 in China, APT1 is the subject of a US indictment of 19 May 2014 charging five Unit 61398 officers with hacking six US organizations. The Department of Justice alleges the aim was commercial gain for China's state-owned firms.

Attributed by the US Department of Justice (indictment of 19 May 2014) and MITRE ATT&CK

  • CNAttributed to China
Active since 2006 Full profile

Keep exploring

Knowledge Hub

Glossary term

MITRE ATT&CK

MITRE ATT&CK is a globally-accessible knowledge base of adversary tactics and techniques based on real-world observations.

Read more

Malware

FASTCash

FASTCash is the name the US Government gives to an ATM cash-out scheme and the malware behind it.

Read more

Threat group

Lazarus Group

Lazarus Group is the name used by MITRE, the US Treasury and the US Department of Justice for North Korean hacking units that, they say, work for the Reconnaissance General Bureau. The US charged three RGB members in 2020 and 2021 with attempts to steal or extort more than $1.3 billion, and the FBI attributed the 2025 Bybit theft to North Korean actors it tracks as TraderTraitor.

Read more

Glossary term

Reconnaissance

Reconnaissance is the stage where an attacker gathers information to plan later operations.

Read more