North KoreaAttributedRGBFinancialActive 2014 – 2026BlueNoroff
Also known asStardust Chollima · Sapphire Sleet · COPERNICIUM · TA444 · NICKEL GLADSTONE · BeagleBoyz · TAG-71 · CTG-6459 · T-APT-15 · ATK117 · Black Alicanto · Alluring Pisces · UNC1069 · CryptoCore · CageyChameleon
Summary
DPRK dedicated financial theft unit — $2B+ from SWIFT banks and crypto. FASTCash ATM cash-out across 30+ countries. The Feb 2025 ~$1.5B Bybit theft was attributed by the FBI to TraderTraitor (tracked here as Jade Sleet), not to this cluster. 2025–2026: fake Zoom/Teams meeting and ClickFix lures with AI-generated deepfake video against Web3 executives (Kaspersky GhostCall/GhostHire, Arctic Wolf); GTIG's UNC1069 (Sapphire Sleet per Microsoft) compromised the axios npm package on 31 Mar 2026. Revenue funds DPRK nuclear program.
Attribution
Financial-theft sub-group of Lazarus
Named by a government: indictment, sanctions designation, joint advisory or official statement.
- US Treasury (OFAC) (Government, 2019-09-13)
Sanctions: a Lazarus sub-group controlled by the RGB - MITRE ATT&CK (MITRE ATT&CK, 2026-10)
Attributed to the Reconnaissance General Bureau - Mandiant (Research, 2022-03-23)
APT38 is likely subordinate to Lab 110
Campaigns 6
| Campaign | Period | Targets | Sectors | Source |
|---|---|---|---|---|
| Mastra npm supply-chain compromise (easy-day-js typosquat; 140+ @mastra packages) | 2026-06 | Global | Software Development, AI | Microsoft Threat Intelligence (2026-06-17) |
| Axios npm supply-chain compromise (Sapphire Sleet / UNC1069, WAVESHAPER.V2) | 2026-03 | Global | Technology, Open Source, Cryptocurrency | Microsoft (2026-04-01); GTIG (2026-03-31) |
| Fake interview → "Zoom/Teams SDK Update.scpt" macOS intrusions | 2026-01 – 2026-06 | Global | Financial Services, Cryptocurrency, Venture Capital | Microsoft Threat Intelligence (2026-04-16, updated 2026-06) |
| Web3 deepfake Zoom/Teams ClickFix intrusions | 2026-01 – 2026-03 | USA, Global | Cryptocurrency, Web3 | Arctic Wolf Labs (2026-04-27) |
| CurlyVeilTea targeted intrusions — UAE financial-services network, South Korea, Canada, India (axios attackers)ASSESSED | 2025-12 – 2026-03 | UAE, South Korea, Canada, India | Finance, Cryptocurrency | ESET APT Activity Report Q4 2025–Q1 2026 (2026-05-28) — operation DangerousPassword |
| GhostCall / GhostHire | 2025-04 – 2025-10 | India, Turkey, Australia, Europe, Asia | Cryptocurrency, Web3, Venture Capital | Kaspersky GReAT (2025-10-28) |
Newest first. ASSESSED: tied to the actor with hedging or through an alias. CLAIMED: an allegation no independent source confirms.
MITRE ATT&CK techniques 24
Malware and tools 13
| Name | Description | Platform |
|---|---|---|
| FASTCash | ATM/SWIFT Malware | AIX/Windows |
| FULLHOUSE | Backdoor | Windows |
| Hermes | Ransomware/Wiper (cover) | Windows |
| ELECTRICFISH | Tunneling | Windows |
| RustBucket | macOS Backdoor | macOS |
| KandyKorn | macOS Backdoor | macOS |
| ObjCShellz | macOS Reverse Shell | macOS |
| TodoSwift | macOS Dropper | macOS |
| CosmicDoor | Backdoor (Nim/Go) | macOS/Windows |
| DownTroy | Downloader/Backdoor | macOS/Windows |
| WAVESHAPER.V2 | Backdoor (C++) | Windows/macOS/Linux |
| DEEPBREATH | Data Miner (Swift) | macOS |
| CHROMEPUSH | Browser extension / data stealer | macOS |
Infrastructure patterns
- Telegram bots and GitHub repositories deliver fake skill-assessment payloads (Kaspersky, 2025)
- Compromised npm packages reach developers — Axios (Apr 2026), Mastra (Jun 2026) (Microsoft, 2026)
- Fake recruiter → fake technical interview → "Zoom/Teams SDK update" AppleScript on macOS (Microsoft, 2026)
Reporting and advisories 7
- CISA
AA20-239A — FASTCash 2.0 DPRK ATM Campaign - Google Threat Intelligence Group
Axios npm supply-chain compromise (UNC1069, WAVESHAPER.V2) - Kaspersky GReAT
GhostCall / GhostHire - Arctic Wolf Labs
Web3 deepfake Zoom/Teams ClickFix intrusions - Microsoft Threat Intelligence
Mastra npm supply-chain compromise (easy-day-js typosquat; 140+ @mastra packages) - Microsoft Threat Intelligence
Fake interview → "Zoom/Teams SDK Update.scpt" macOS intrusions - MITRE ATT&CK
BlueNoroff (G0082) group profile