{ "name": "Adversary Atlas API", "version": "1.0.0", "description": "Read-only JSON API over the Adversary Atlas threat actor dataset. Statically generated at build time; no authentication, no rate limits.", "generated": "2026-07-31T01:06:07.226Z", "datasetCurrentAsOf": "2025-09-01", "license": "Data compiled from public primary sources; see /methodology/ for sourcing.", "actor": { "id": "apt38", "slug": "apt38", "name": "APT38", "shortName": "APT38", "country": "North Korea", "countryCode": "KP", "sponsorship": "state-sponsored", "status": "active", "activeSince": "2014", "prominence": 85, "mitreGroupId": "G0082", "malpediaSlug": "bluenoroff", "tagline": "The bank-robbery specialists. Attempted $1.1 billion in theft from financial institutions, and destroys the evidence on the way out.", "bio": "APT38 — also tracked as BlueNoroff — is the element of North Korea's cyber programme built specifically to steal from financial institutions, and it operates more like a professional heist crew than an espionage group.\n\nMandiant's 2018 analysis documented attempted theft exceeding $1.1 billion across banks in at least sixteen countries. The methodology is patient and process-driven: obtain access, then spend months — sometimes more than a year — studying the target's internal transaction workflows, approval chains, and reconciliation procedures before attempting anything. The theft itself is fast; the reconnaissance preceding it is not.\n\nThe 2016 Bangladesh Bank operation illustrates the model. Operators compromised the bank's environment, studied its SWIFT procedures, deployed malware that manipulated the SWIFT client software and suppressed the printed confirmations staff would have used to notice the fraud, and timed the operation to a weekend spanning different national holidays in Bangladesh, the U.S., and the Philippines to maximise the window before anyone reconciled.\n\nWhat distinguishes APT38 from criminal financial actors is its willingness to destroy. Operations routinely conclude with wiper deployment across the victim's environment — both to impede forensic reconstruction and to delay recovery while the funds move through laundering channels. Its targets extend beyond banks to cryptocurrency exchanges, ATM networks, and interbank messaging infrastructure.", "attribution": { "sponsor": "North Korea", "service": "RGB — Reconnaissance General Bureau", "unit": "Bluenoroff / financial operations element", "confidence": "confirmed", "summary": "Sanctioned by the U.S. Treasury in September 2019 as Bluenoroff, an RGB-controlled entity, alongside Lazarus and Andariel. The February 2021 DOJ superseding indictment against three RGB officers covers financially motivated operations including bank heists and cryptocurrency theft. Mandiant tracks APT38 as a distinct financially motivated group operating under the same state structure as Lazarus.", "sources": [ { "org": "Mandiant / FireEye", "title": "APT38: Un-usual Suspects — Details on North Korea's financially motivated operations", "url": "https://services.google.com/fh/files/misc/apt38-report.pdf", "date": "2018-10-03" }, { "org": "U.S. Department of the Treasury", "title": "Treasury Sanctions North Korean State-Sponsored Malicious Cyber Groups", "url": "https://home.treasury.gov/news/press-releases/sm774", "date": "2019-09-13" } ] }, "motivations": [ "financial-gain", "sabotage" ], "targetSectors": [ "Financial Services", "Cryptocurrency", "Technology", "Retail & Hospitality", "Government" ], "targetCountries": [ "Bangladesh", "Vietnam", "Mexico", "Chile", "Taiwan", "India", "Malta", "United States", "South Korea", "Poland", "Türkiye" ], "aliases": [ { "org": "mitre", "name": "APT38", "url": "https://attack.mitre.org/groups/G0082/", "correlation": "exact" }, { "org": "microsoft", "name": "Sapphire Sleet", "correlation": "exact", "note": "Formerly COPERNICIUM" }, { "org": "crowdstrike", "name": "Stardust Chollima", "correlation": "exact" }, { "org": "mandiant", "name": "APT38", "correlation": "exact" }, { "org": "kaspersky", "name": "BlueNoroff", "correlation": "exact" }, { "org": "secureworks", "name": "NICKEL GLADSTONE", "correlation": "exact" }, { "org": "unit42", "name": "Sparkling Pisces", "correlation": "partial", "note": "Overlapping DPRK financial-operations cluster" }, { "org": "cisa", "name": "BeagleBoyz", "correlation": "exact", "note": "U.S. government designator used in the FASTCash advisories" }, { "org": "symantec", "name": "Bluenoroff", "correlation": "exact" } ], "tools": [ { "name": "FASTCash", "type": "malware", "custom": true, "description": "AIX and Linux implant injected into bank switch application servers, intercepting ISO 8583 transaction messages and approving fraudulent ATM withdrawals.", "malpediaSlug": "aix.fastcash" }, { "name": "DYEPACK", "type": "malware", "custom": true, "description": "SWIFT manipulation framework that alters transaction records and suppresses printed confirmations to delay detection." }, { "name": "MATA framework", "type": "framework", "custom": true, "description": "Cross-platform post-exploitation framework with Windows, Linux, and macOS components.", "malpediaSlug": "win.mata" }, { "name": "SnatchCrypto lures", "type": "utility", "custom": true, "description": "Fake venture capital and investment firm personas approaching cryptocurrency startups with funding offers." }, { "name": "Custom wipers", "type": "wiper", "custom": true, "description": "Deployed at the conclusion of operations to destroy forensic evidence and delay recovery." }, { "name": "RustBucket", "type": "backdoor", "custom": true, "description": "macOS backdoor delivered via a malicious PDF viewer, targeting cryptocurrency firms." } ], "techniques": [ { "tCode": "T1566.001", "name": "Phishing: Spearphishing Attachment", "tactic": "Initial Access", "note": "Investment and partnership lures to cryptocurrency and financial staff" }, { "tCode": "T1195", "name": "Supply Chain Compromise", "tactic": "Initial Access" }, { "tCode": "T1078", "name": "Valid Accounts", "tactic": "Persistence", "note": "Extended dwell — often more than a year studying transaction workflows before acting" }, { "tCode": "T1055", "name": "Process Injection", "tactic": "Defense Evasion", "note": "Injection into bank switch application processes" }, { "tCode": "T1565.001", "name": "Data Manipulation: Stored Data Manipulation", "tactic": "Impact", "note": "Alteration of SWIFT transaction records" }, { "tCode": "T1657", "name": "Financial Theft", "tactic": "Impact", "note": "$1.1bn in attempted theft across at least 16 countries" }, { "tCode": "T1485", "name": "Data Destruction", "tactic": "Impact", "note": "Wiper deployment after theft to impede forensics" }, { "tCode": "T1070.001", "name": "Indicator Removal: Clear Windows Event Logs", "tactic": "Defense Evasion" }, { "tCode": "T1213", "name": "Data from Information Repositories", "tactic": "Collection", "note": "Internal transaction procedure documentation" }, { "tCode": "T1005", "name": "Data from Local System", "tactic": "Collection" } ], "cves": [ { "cveId": "CVE-2021-44228", "firstExploited": "2022-01-01", "usage": "Log4Shell exploited against internet-facing applications at financial-sector targets for initial access.", "source": { "org": "CISA / FBI / Treasury", "title": "North Korean State-Sponsored Cyber Actors Use Maui Ransomware (AA22-187A)", "url": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-187a", "date": "2022-07-06" } }, { "cveId": "CVE-2023-42793", "firstExploited": "2023-10-01", "usage": "TeamCity RCE exploited for access to build systems at software and financial technology organisations.", "source": { "org": "Microsoft Threat Intelligence", "title": "Multiple North Korean threat actors exploiting the TeamCity CVE-2023-42793 vulnerability", "url": "https://www.microsoft.com/en-us/security/blog/2023/10/18/multiple-north-korean-threat-actors-exploiting-the-teamcity-cve-2023-42793-vulnerability/", "date": "2023-10-18" } } ], "relationships": [ { "relatedActorId": "lazarus", "type": "suspected-subgroup", "confidence": "confirmed", "note": "Operates under the same RGB structure; vendors differ on whether to model it as a distinct group or a Lazarus subgroup." }, { "relatedActorId": "andariel", "type": "same-sponsor", "confidence": "confirmed", "note": "Both RGB elements sanctioned together by the U.S. Treasury in September 2019." } ], "reports": [ { "org": "Mandiant / FireEye", "title": "APT38: Un-usual Suspects", "url": "https://services.google.com/fh/files/misc/apt38-report.pdf", "date": "2018-10-03" }, { "org": "CISA / FBI / Treasury", "title": "FASTCash 2.0: North Korea's BeagleBoyz Robbing Banks (AA20-239A)", "url": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa20-239a", "date": "2020-08-26" }, { "org": "Kaspersky GReAT", "title": "The BlueNoroff cryptocurrency hunt is still on (SnatchCrypto)", "url": "https://securelist.com/the-bluenoroff-cryptocurrency-hunt-is-still-on/105488/", "date": "2022-01-13" } ], "campaigns": [], "flag": "🇰🇵", "profile": "/apt/apt38/" } }