North KoreaAttributedRGB 3rd BureauMixedActive 2009 – 2026Andariel
Also known asOnyx Sleet · Silent Chollima · Stonefly · PLUTONIUM · Jumpy Pisces · Whois Team
Summary
DPRK RGB-linked actor (MITRE G0138; CrowdStrike: Silent Chollima). Tracked since 2014. Dual mandate: military and aerospace espionage + financially motivated ransomware to fund DPRK operations. July 2024: DoJ indictment of Rim Jong Hyok for hospital/defence intrusions and Maui ransomware deployment against US healthcare. Targets defence, nuclear, aerospace, and engineering organisations in the US, South Korea, Japan, and India. Heavy use of PowerShell-based loaders and the No-Pineapple toolkit per WithSecure.
Attribution
Named by a government: indictment, sanctions designation, joint advisory or official statement.
- US Treasury (OFAC) (Government, 2019-09-13)
Sanctions: a Lazarus sub-group controlled by the RGB - FBI, CISA, NSA and partners (AA24-207A) (Government, 2024-07-25)
Joint advisory: an RGB 3rd Bureau group based in Pyongyang and Sinuiju - MITRE ATT&CK (MITRE ATT&CK, 2026-10)
A Lazarus sub-set attributed to the RGB
Campaigns 5
| Campaign | Period | Targets | Sectors | Source |
|---|---|---|---|---|
| TigerRAT and attempted Rook ransomware at a South Korean engineering company (industrial equipment) | 2026-03 | South Korea | Engineering, Manufacturing | ESET APT Activity Report Q4 2025–Q1 2026 (2026-05-28) |
| AI-assisted exploit development — mass CVE analysis and PoC validation with Gemini (no victim intrusion reported) | 2026-02 – 2026-05 | Global | Multiple | Google Threat Intelligence Group (2026-05-11) |
| ROK ERP-software targeting & European public/legal-sector breach (StarshellRAT / JelusRAT / GopherRAT) | 2025 | South Korea, Europe | Software / ERP, Legal, Public Sector | WithSecure Labs (2026-01-22) |
| Defence & Nuclear Espionage | 2023 – 2024 | USA, South Korea, UK | Defense, Nuclear, Aerospace | FBI/CISA/NSA/NCSC/NIS et al. AA24-207A (2024-07-25) |
| Maui Ransomware Healthcare Campaign | 2021-05 – 2022-07 | USA | Healthcare | FBI/CISA/Treasury AA22-187A (2022-07-06) — "Since May 2021": ongoing at publication; US DOJ (2024-07-25) indictment gives no activity dates |
Newest first. ASSESSED: tied to the actor with hedging or through an alias. CLAIMED: an allegation no independent source confirms.
MITRE ATT&CK techniques 8
| Reconnaissance2 | T1590.005IP AddressesT1592.002Software |
|---|---|
| Initial Access2 | T1190Exploit Public-Facing ApplicationT1566.001Spearphishing Attachment |
| Execution1 | T1059.001PowerShell |
| Stealth1 | T1027.003Steganography |
| Credential Access1 | T1003OS Credential Dumping |
| Impact1 | T1486Data Encrypted for Impact |
Malware and tools 8
| Name | Description | Platform |
|---|---|---|
| Maui | Ransomware | Windows |
| Dtrack | RAT | Windows |
| TigerRAT | RAT | Windows |
| NukeSped | RAT | Windows |
| StarshellRAT | RAT | Windows |
| JelusRAT | RAT | Windows |
| GopherRAT | RAT (Go) | Windows |
| Rook | Ransomware | Windows |
Exploited vulnerabilities 3
| CVE | CVSS | Detail |
|---|---|---|
| CVE-2021-44228 | 10 | Apache Log4Shell (KEV 2021-12-10) |
| CVE-2023-46604 | 10 | Apache ActiveMQ — deserialization RCE (KEV 2023-11-02) |
| CVE-2022-47966 | 9.8 | Zoho ManageEngine unauthenticated RCE (KEV 2023-01-23) |
Highest CVSS first.
Infrastructure patterns
- Watering holes limited to chosen IP ranges, profiling visitors' browsers first (MITRE ATT&CK, 2026)
Reporting and advisories 6
- CISA
AA22-187A — North Korea Maui Ransomware Targeting Healthcare - DoJ
Indictment — Rim Jong Hyok (Andariel 2024) - CISA
AA24-207A — North Korea Cyber Group Conducts Global Espionage Campaign (RGB 3rd Bureau; IOC package) - WithSecure Labs
ROK ERP-software targeting & European public/legal-sector breach (StarshellRAT / JelusRAT / GopherRAT) - Google Threat Intelligence Group
AI-assisted exploit development — mass CVE analysis and PoC validation with Gemini (no victim intrusion reported) - MITRE ATT&CK
Andariel (G0138) group profile