MITRE ATT&CKgroup
G0082 APT38
- Domain
- enterprise, ics
- Aliases
- NICKEL GLADSTONE, BeagleBoyz, Bluenoroff, Stardust Chollima, Sapphire Sleet, COPERNICIUM
- Version
- 4.0
- Created
- 2019-01-29
Description
APT38 is a North Korean state-sponsored threat group that specializes in financial cyber operations; it has been attributed to the Reconnaissance General Bureau. Active since at least 2014, APT38 has targeted banks, financial institutions, casinos, cryptocurrency exchanges, SWIFT system endpoints, and ATMs in at least 38 countries worldwide. Significant operations include the 2016 Bank of Bangladesh heist, Bancomext and Banco de Chile , along with software supply chain compromises and destructive malware attacks.
North Korean group definitions are known to have significant overlap, and some security researchers report all North Korean state-sponsored cyber activity under the name Lazarus Group instead of tracking clusters or subgroups.
Related
Uses · MITRE ATT&CK (121)
- T1684.001 Impersonation sub-technique
- T1685 Disable or Modify Tools technique
- T1685.003 Modify or Spoof Tool UI sub-technique
- T1685.005 Clear Windows Event Logs sub-technique
- T1686 Disable or Modify System Firewall technique
- T1686.002 Network Device Firewall sub-technique
- T1690 Prevent Command History Logging technique
- T1683.001 Written Content sub-technique
- T1683.002 Audio-Visual Content sub-technique
- T1678 Delay Execution technique
- T1213.006 Databases sub-technique
- T1677 Poisoned Pipeline Execution technique
- T1027.015 Compression sub-technique
- T1027.016 Junk Code Insertion sub-technique
- T1480.002 Mutual Exclusion sub-technique
- T1213.005 Messaging Applications sub-technique
- T1564.012 File/Path Exclusions sub-technique
- T1548.006 TCC Manipulation sub-technique
- T1564.011 Ignore Process Interrupts sub-technique
- T1657 Financial Theft technique
- T1027.010 Command Obfuscation sub-technique
- T1036.008 Masquerade File Type sub-technique
- T1546.016 Installer Packages sub-technique
- T1586.003 Cloud Accounts sub-technique
- T1620 Reflective Code Loading technique
- S0593 ECCENTRICBANDWAGON software (malware)
- T1608.001 Upload Malware sub-technique
- T1553.005 Mark-of-the-Web Bypass sub-technique
- S0607 KillDisk software (malware)
- T1053.006 Systemd Timers sub-technique
References
- https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2021GTR.pdf CrowdStrike GTR 2021 June 2021
- https://www.justice.gov/opa/pr/three-north-korean-military-hackers-indicted-wide-ranging-scheme-commit-cyberattacks-and DOJ North Korea Indictment Feb 2021
- https://us-cert.cisa.gov/ncas/alerts/aa20-239a CISA AA20-239A BeagleBoyz August 2020
- https://services.google.com/fh/files/misc/apt38-un-usual-suspects.pdf FireEye APT38 Oct 2018
- https://securelist.com/lazarus-under-the-hood/77908/ Kaspersky Lazarus Under The Hood Blog 2017
- https://www.crowdstrike.com/blog/meet-crowdstrikes-adversary-of-the-month-for-april-stardust-chollima/ CrowdStrike Stardust Chollima Profile April 2018
- https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide Microsoft Threat Actor Naming July 2023
- https://www.microsoft.com/en-us/security/blog/2026/04/01/mitigating-the-axios-npm-supply-chain-compromise/ Microsoft Axios Compromise APR 2026
- https://www.microsoft.com/en-us/security/blog/2026/04/16/dissecting-sapphire-sleets-macos-intrusion-from-lure-to-compromise/ Microsoft Sapphire Sleet APR 2026
- https://www.microsoft.com/en-us/security/blog/2026/06/17/postinstall-payload-inside-mastra-npm-supply-chain-compromise/ MIcrosoft Mastra npm Compromise JUN 2026
- https://www.secureworks.com/research/threat-profiles/nickel-gladstone SecureWorks NICKEL GLADSTONE profile Sept 2021