APT · North Korea
DPRK-linked group conducting cryptocurrency theft, SWIFT banking attacks, and destructive wiper operations.
Aliases: Hidden Cobra, ZINC, Labyrinth Chollima
Motivation: Financial gain and espionage
Initial Access
Field telemetry from Tokyo correlates with Apple Zero-Click iMessage Exploit Sold on Exploit Broker Forum.
Privilege Escalation
Field telemetry from Berlin correlates with Cl0p Exploits New Zero-Day in Enterprise File Transfer Suite.
Reconnaissance
Field telemetry from New Delhi correlates with APT28 DNC-Style Disinformation Campaign Ahead of Elections.
Privilege Escalation
Field telemetry from Tokyo correlates with Apple Zero-Click iMessage Exploit Sold on Exploit Broker Forum.
Lateral Movement
Field telemetry from Berlin correlates with Cl0p Exploits New Zero-Day in Enterprise File Transfer Suite.
Initial Access
Field telemetry from New Delhi correlates with APT28 DNC-Style Disinformation Campaign Ahead of Elections.
Data Exfiltration
Field telemetry from Berlin correlates with Cl0p Exploits New Zero-Day in Enterprise File Transfer Suite.
Privilege Escalation
Field telemetry from New Delhi correlates with APT28 DNC-Style Disinformation Campaign Ahead of Elections.
Lateral Movement
Field telemetry from Tokyo correlates with Apple Zero-Click iMessage Exploit Sold on Exploit Broker Forum.