MITRE ATT&CKgroup

G0138 Andariel

Published 2021-09-29 Modified 2026-07-31 Official page ↗
Domain
enterprise
Aliases
Silent Chollima, PLUTONIUM, Onyx Sleet
Version
2.0
Created
2021-09-29

Description

Andariel is a North Korean state-sponsored threat group that has been active since at least 2009. Andariel has primarily focused its operations--which have included destructive attacks--against South Korean government agencies, military organizations, and a variety of domestic companies; they have also conducted cyber financial operations against ATMs, banks, and cryptocurrency exchanges. Andariel's notable activity includes Operation Black Mine, Operation GoldenAxe, and Campaign Rifle. Andariel is considered a sub-set of Lazarus Group, and has been attributed to North Korea's Reconnaissance General Bureau. North Korean group definitions are known to have significant overlap, and some security researchers report all North Korean state-sponsored cyber activity under the name Lazarus Group instead of tracking clusters or subgroups.

Related

Uses · MITRE ATT&CK (14)

  • T1590.005 IP Addresses sub-technique
  • T1592.002 Software sub-technique
  • T1588.001 Malware sub-technique
  • S0433 Rifdoor software (malware)
  • T1204.002 Malicious File sub-technique
  • T1566.001 Spearphishing Attachment sub-technique
  • T1027.003 Steganography sub-technique
  • T1189 Drive-by Compromise technique
  • T1203 Exploitation for Client Execution technique
  • S0032 gh0st RAT software (malware)
  • T1005 Data from Local System technique
  • T1049 System Network Connections Discovery technique
  • T1057 Process Discovery technique
  • T1105 Ingress Tool Transfer technique

References