APT38
Alias-Namen: NICKEL GLADSTONE, BeagleBoyz, Bluenoroff, Stardust Chollima, Sapphire Sleet, COPERNICIUM
6
3
16.04.2026
30.07.2026
Profil laut MITRE ATT&CK
APT38 is a North Korean state-sponsored threat group that specializes in financial cyber operations; it has been attributed to the Reconnaissance General Bureau. Active since at least 2014, APT38 has targeted banks, financial institutions, casinos, cryptocurrency exchanges, SWIFT system endpoints, and ATMs in at least 38 countries worldwide. Significant operations include the 2016 Bank of Bangladesh heist, during which APT38 stole $81 million, as well as attacks against Bancomext and Banco de Chile; some of their attacks have been destructive. North Korean group definitions are known to have significant overlap, and some security researchers report all North Korean state-sponsored cyber activity under the name Lazarus Group instead of tracking clusters or subgroups.
Vollständiges MITRE-ProfilBeschreibung und Alias-Namen stammen aus MITRE ATT&CK®.
Nennungen im Zeitverlauf
Meldungen je Monat, letzte 12 Monate.
Beobachtete Techniken
ATT&CK-Techniken, die in denselben Meldungen benannt sind — nicht das vollständige MITRE-Repertoire.
T1587.001 Malware
Resource Development
T1588.001 Malware
Resource Development
T1566 Phishing
Initial Access
T1583.001 Domains
Resource Development
T1584.001 Domains
Resource Development
T1589.001 Credentials
Reconnaissance
T1053.005 Scheduled Task
Execution · Persistence · Privilege Escalation
T1059.001 PowerShell
Execution
T1102 Web Service
Command & Control
T1113 Screen Capture
Collection
T1204.002 Malicious File
Execution
T1218.010 Regsvr32
stealth
Gemeinsam genannt
Betroffene Branchen
Meldungen
Amazon Links Debug and Chalk npm Hijack to North Korea’s Sapphire Sleet
BlueNoroff Zoom Phishing Kit Profiles Crypto Wallets Before Malware Delivery
Microsoft links Mastra AI supply chain attack to North Korean hackers
Kimsuky targets organizations with PebbleDash-based tools
BlueNoroff Uses Fake Zoom Calls to Turn Victims Into Attack Lures
North Korea Uses ClickFix to Target macOS Users' Data
Quellen: The Hacker News (2), Dark Reading (2), BleepingComputer (1), Securelist (1)
Alle Angaben auf dieser Seite stammen aus dem Alias-Abgleich der Meldungstexte gegen den MITRE-ATT&CK-Katalog. Beziehungen entstehen rein statistisch: Zwei Einträge gelten als verbunden, wenn sie in derselben Meldung benannt sind. Das ist keine eigenständige Attribution durch SecBoard, und eine Nennung ist kein Nachweis einer Täterschaft.