Skip to content

APT38

APT38 is a North Korean state-sponsored threat group that specializes in financial cyber operations; it has been attributed to the Reconnaissance General Bureau. Active since at least 2014, APT38 has targeted banks, financial institutions, casinos, cryptocurrency exchanges, SWIFT system endpoints, and ATMs in at least 38 countries worldwide. Significant operations include the 2016 Bank of Bangladesh heist, Bancomext and Banco de Chile, along with software supply chain compromises and destructive malware attacks. North Korean group definitions are known to have significant overlap, and some security researchers…

ATT&CK ID: G0082
Origin: North Korea
Weather family: Sleet
Techniques: 70
Tools: 6

Also tracked as NICKEL GLADSTONE · BeagleBoyz · Bluenoroff · Stardust Chollima · Sapphire Sleet · COPERNICIUM

Techniques

Resource Development

Acquire Infrastructure Establish Accounts Compromise Accounts Obtain Capabilities Stage Capabilities Generate Content

Initial Access

Valid Accounts Drive-by Compromise Supply Chain Compromise Phishing

Execution

Scheduled Task/Job Command and Scripting Interpreter Native API User Execution System Services Poisoned Pipeline Execution

Persistence

Scheduled Task/Job Valid Accounts Modify Registry Server Software Component Create or Modify System Process Event Triggered Execution Boot or Logon Autostart Execution

Privilege Escalation

Scheduled Task/Job Process Injection Valid Accounts Create or Modify System Process Event Triggered Execution Boot or Logon Autostart Execution Abuse Elevation Control Mechanism

Stealth

Obfuscated Files or Information Masquerading Process Injection Indicator Removal Valid Accounts Deobfuscate/Decode Files or Information System Binary Proxy Execution Execution Guardrails Hide Artifacts Reflective Code Loading Delay Execution Social Engineering

Defense Impairment

Modify Registry File and Directory Permissions Modification Subvert Trust Controls Disable or Modify Tools Disable or Modify System Firewall Prevent Command History Logging

Credential Access

Input Capture Brute Force Unsecured Credentials Credentials from Password Stores

Discovery

Query Registry System Owner/User Discovery System Network Connections Discovery Process Discovery System Information Discovery File and Directory Discovery System Time Discovery Network Share Discovery Browser Information Discovery Software Discovery

Collection

Data from Local System Input Capture Data Staged Clipboard Data Data from Information Repositories Archive Collected Data

Command and Control

Application Layer Protocol Ingress Tool Transfer Data Encoding Non-Standard Port

Exfiltration

Exfiltration Over C2 Channel Exfiltration Over Alternative Protocol Exfiltration Over Web Service

Impact

Data Destruction Data Encrypted for Impact System Shutdown/Reboot Disk Wipe Data Manipulation Financial Theft

Software

DarkComet · ECCENTRICBANDWAGON · HOPLIGHT · KillDisk · Mimikatz · Net

MITRE ATT&CK All threat actors