APT · North Korea
DPRK-linked group conducting cryptocurrency theft, SWIFT banking attacks, and destructive wiper operations.
Псевдонимы: Hidden Cobra, ZINC, Labyrinth Chollima
Мотивация: Financial gain and espionage
Первичный доступ
Field telemetry from Tokyo correlates with Apple Zero-Click iMessage Exploit Sold on Exploit Broker Forum.
Повышение привилегий
Field telemetry from Berlin correlates with Cl0p Exploits New Zero-Day in Enterprise File Transfer Suite.
Разведка
Field telemetry from New Delhi correlates with APT28 DNC-Style Disinformation Campaign Ahead of Elections.
Повышение привилегий
Field telemetry from Tokyo correlates with Apple Zero-Click iMessage Exploit Sold on Exploit Broker Forum.
Боковое перемещение
Field telemetry from Berlin correlates with Cl0p Exploits New Zero-Day in Enterprise File Transfer Suite.
Первичный доступ
Field telemetry from New Delhi correlates with APT28 DNC-Style Disinformation Campaign Ahead of Elections.
Эксфильтрация данных
Field telemetry from Berlin correlates with Cl0p Exploits New Zero-Day in Enterprise File Transfer Suite.
Повышение привилегий
Field telemetry from New Delhi correlates with APT28 DNC-Style Disinformation Campaign Ahead of Elections.
Боковое перемещение
Field telemetry from Tokyo correlates with Apple Zero-Click iMessage Exploit Sold on Exploit Broker Forum.