Actors/Nation-state / APT/Asia

APT45

APTKP · North Korea

AKA Andariel · LABYRINTH CHOLLIMA · Onyx Sleet · Operation Troy · DarkSeoul · Stonefly

CrowdStrike: SILENT CHOLLIMAMicrosoft: PLUTONIUM

Targets25

Sectors18

Threat types2

GIRs covered0/480

Active since2009

Victimology

Geographic footprint · 25 countries

origin · North Koreatargeted countries · 25

AMERICAS · 4

Argentina · Brazil · Canada · United States

OCEANIA · 1

Australia

EUROPE · 12

Belgium · Switzerland · Germany · Denmark · Estonia · Hungary · Norway · Poland · Romania · Russia · Sweden · Slovenia

ASIA · 8

China · Israel · India · Japan · South Korea · Philippines · Türkiye · Vietnam

Sectors targeted

18 of 40

Government83 actors Defense60 actors Aerospace49 actors Financial Services61 actors Healthcare38 actors Pharmaceutical24 actors Telecom57 actors Retail & Hospitality25 actors Energy / Utilities49 actors Education & Research50 actors Manufacturing (man)40 actors Media & Journalism41 actors Hospitality26 actors Consulting / Professional Services26 actors Chemicals15 actors Consumer Goods / Electronics16 actors Agriculture & Food15 actors Maritime21 actors

Tactics, techniques, procedures

Threat types + MITRE ATT&CK mapping

THREAT TYPES

ESP · EspionageRAN · Ransomware

MITRE ATT&CK · 9 techniques

Reconnaissance · 1

T1592.002Software

Initial Access · 2

T1189Drive-by Compromise

Execution · 1

T1203Exploitation for Client Execution

Discovery · 2

T1049System Network Connections Discovery

Collection · 1

T1005Data from Local System

Command And Control · 1

T1105Ingress Tool Transfer

Stealth · 1

T1027.003Steganography

GIR coverage

0 / 480 requirements satisfied

Open matrix

No GIRs mapped yet for this actor.

Related actors

By origin and actor type

T1566.001

Spearphishing Attachment

T1057

Process Discovery