APT38 is a North Korean state-sponsored threat group that specializes in financial cyber operations; it has been attributed to the Reconnaissance General Bureau.1 Active since at least 2014, APT38 has targeted banks, financial institutions, casinos, cryptocurrency exchanges, SWIFT system endpoints, and ATMs in at least 38 countries worldwide. Significant operations include the 2016 Bank of Bangladesh heist, Bancomext 2 and Banco de Chile 3, along with software supply chain compromises and destructive malware attacks.45678910 North Korean group definitions are known to have significant overlap, and some security researchers report all North Korean state-sponsored cyber activity under the name Lazarus Group instead of tracking clusters or subgroups.
- CISA AA20-239A BeagleBoyz August 2020
- FireEye APT38 Oct 2018
- FireEye APT38 Oct 2018
- CISA AA20-239A BeagleBoyz August 2020
- FireEye APT38 Oct 2018
- DOJ North Korea Indictment Feb 2021
- Kaspersky Lazarus Under The Hood Blog 2017
- Microsoft Axios Compromise APR 2026
- Microsoft Sapphire Sleet APR 2026
- MIcrosoft Mastra npm Compromise JUN 2026
Claims and citations
Every claim comes from a writer; provenance is the writer's assertion, not a review verdict from this directory. Validity reads by citation year.
| predicate | object | Valid | Conf. | Evidence |
|---|---|---|---|---|
| also_known_as | APT38 | — → … | 100 | src_mitre_attck_enterprise |
| also_known_as | NICKEL GLADSTONE | — → … | 100 | src_mitre_attck_enterprise |
| also_known_as | BeagleBoyz | — → … | 100 | src_mitre_attck_enterprise |
| also_known_as | Bluenoroff | — → … | 100 | src_mitre_attck_enterprise |
| also_known_as | Stardust Chollima | — → … | 100 | src_mitre_attck_enterprise |
| also_known_as | Sapphire Sleet | — → … | 100 | src_mitre_attck_enterprise |
| also_known_as | COPERNICIUM | — → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1486 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1055 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1033 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1657 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1112 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1036.005 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1677 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1049 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1070.004 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1036.006 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1608.001 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1056.001 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1056.002 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1518.001 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1543.003 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1564.011 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1213.006 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1548.002 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1678 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1189 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1683.002 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1053.006 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1083 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1213.005 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1070.003 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.003 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1140 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.002 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1685.003 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1585.002 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.005 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1074.001 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1585.001 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1027.015 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1529 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1204.001 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1071.001 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1105 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1685 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1583.006 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1012 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1027.002 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1217 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1685.005 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1684.001 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1566.003 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.006 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1543.001 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1218.005 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1070.006 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1686 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1480 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1583.003 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1485 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1110 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1124 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.004 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1135 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1553.005 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1567 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1082 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1195.001 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1132.001 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1565.002 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1041 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1686.002 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1561.002 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1036.003 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1690 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1036.008 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1053.005 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1552.004 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1588.002 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1505.003 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1552.003 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1115 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1555.003 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1586.003 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1548.003 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1555.001 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1620 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.007 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1218.011 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1565.003 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1583.001 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1548.006 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1106 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1218.001 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1547.001 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1204.002 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1555 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1565.001 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1078.004 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1543.004 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1005 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1564.003 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.001 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1027.010 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1053.003 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1566.001 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1566.002 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1218.007 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1078.003 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1683.001 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1027.016 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1571 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1518 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1048.002 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1569.002 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1222.002 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1480.002 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1057 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1546.016 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1564.012 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1560.001 | 2019 → … | 100 | src_mitre_attck_enterprise |
Technique use
| ATT&CK | Technique | platforms |
|---|---|---|
| T1005 | Data from Local System | — |
| T1012 | Query Registry | — |
| T1027.002 | Software Packing | — |
| T1027.010 | Command Obfuscation | — |
| T1027.015 | Compression | — |
| T1027.016 | Junk Code Insertion | — |
| T1033 | System Owner/User Discovery | — |
| T1036.003 | Rename Legitimate Utilities | — |
| T1036.005 | Match Legitimate Resource Name or Location | — |
| T1036.006 | Space after Filename | — |
| T1036.008 | Masquerade File Type | — |
| T1041 | Exfiltration Over C2 Channel | — |
| T1048.002 | Exfiltration Over Asymmetric Encrypted Non-C2 Protocol | — |
| T1049 | System Network Connections Discovery | — |
| T1053.003 | Cron | — |
| T1053.005 | Scheduled Task | — |
| T1053.006 | Systemd Timers | — |
| T1055 | Process Injection | — |
| T1056.001 | Keylogging | — |
| T1056.002 | GUI Input Capture | — |
| T1057 | Process Discovery | — |
| T1059.001 | PowerShell | — |
| T1059.002 | AppleScript | — |
| T1059.003 | Windows Command Shell | — |
| T1059.004 | Unix Shell | — |
| T1059.005 | Visual Basic | — |
| T1059.006 | Python | — |
| T1059.007 | JavaScript | — |
| T1070.003 | Clear Command History | — |
| T1070.004 | File Deletion | — |
| T1070.006 | Timestomp | — |
| T1071.001 | Web Protocols | — |
| T1074.001 | Local Data Staging | — |
| T1078.003 | Local Accounts | — |
| T1078.004 | Cloud Accounts | — |
| T1082 | System Information Discovery | — |
| T1083 | File and Directory Discovery | — |
| T1105 | Ingress Tool Transfer | — |
| T1106 | Native API | — |
| T1110 | Brute Force | — |
| T1112 | Modify Registry | — |
| T1115 | Clipboard Data | — |
| T1124 | System Time Discovery | — |
| T1132.001 | Standard Encoding | — |
| T1135 | Network Share Discovery | — |
| T1140 | Deobfuscate/Decode Files or Information | — |
| T1189 | Drive-by Compromise | — |
| T1195.001 | Compromise Software Dependencies and Development Tools | — |
| T1204.001 | Malicious Link | — |
| T1204.002 | Malicious File | — |
| T1213.005 | Messaging Applications | — |
| T1213.006 | Databases | — |
| T1217 | Browser Information Discovery | — |
| T1218.001 | Compiled HTML File | — |
| T1218.005 | Mshta | — |
| T1218.007 | Msiexec | — |
| T1218.011 | Rundll32 | — |
| T1222.002 | Linux and Mac Permissions | — |
| T1480 | Execution Guardrails | — |
| T1480.002 | Mutual Exclusion | — |
| T1485 | Data Destruction | — |
| T1486 | Data Encrypted for Impact | — |
| T1505.003 | Web Shell | — |
| T1518 | Software Discovery | — |
| T1518.001 | Security Software Discovery | — |
| T1529 | System Shutdown/Reboot | — |
| T1543.001 | Launch Agent | — |
| T1543.003 | Windows Service | — |
| T1543.004 | Launch Daemon | — |
| T1546.016 | Installer Packages | — |
| T1547.001 | Registry Run Keys / Startup Folder | — |
| T1548.002 | Bypass User Account Control | — |
| T1548.003 | Sudo and Sudo Caching | — |
| T1548.006 | TCC Manipulation | — |
| T1552.003 | Shell History | — |
| T1552.004 | Private Keys | — |
| T1553.005 | Mark-of-the-Web Bypass | — |
| T1555 | Credentials from Password Stores | — |
| T1555.001 | Keychain | — |
| T1555.003 | Credentials from Web Browsers | — |
| T1560.001 | Archive via Utility | — |
| T1561.002 | Disk Structure Wipe | — |
| T1564.003 | Hidden Window | — |
| T1564.011 | Ignore Process Interrupts | — |
| T1564.012 | File/Path Exclusions | — |
| T1565.001 | Stored Data Manipulation | — |
| T1565.002 | Transmitted Data Manipulation | — |
| T1565.003 | Runtime Data Manipulation | — |
| T1566.001 | Spearphishing Attachment | — |
| T1566.002 | Spearphishing Link | — |
| T1566.003 | Spearphishing via Service | — |
| T1567 | Exfiltration Over Web Service | — |
| T1569.002 | Service Execution | — |
| T1571 | Non-Standard Port | — |
| T1583.001 | Domains | — |
| T1583.003 | Virtual Private Server | — |
| T1583.006 | Web Services | — |
| T1585.001 | Social Media Accounts | — |
| T1585.002 | Email Accounts | — |
| T1586.003 | Cloud Accounts | — |
| T1588.002 | Tool | — |
| T1608.001 | Upload Malware | — |
| T1620 | Reflective Code Loading | — |
| T1657 | Financial Theft | — |
| T1677 | Poisoned Pipeline Execution | — |
| T1678 | Delay Execution | — |
| T1683.001 | Written Content | — |
| T1683.002 | Audio-Visual Content | — |
| T1684.001 | Impersonation | — |
| T1685 | Disable or Modify Tools | — |
| T1685.003 | Modify or Spoof Tool UI | — |
| T1685.005 | Clear Windows Event Logs | — |
| T1686 | Disable or Modify System Firewall | — |
| T1686.002 | Network Device Firewall | — |
| T1690 | Prevent Command History Logging | — |
Aliases
APT38 · BeagleBoyz · Bluenoroff · COPERNICIUM · NICKEL GLADSTONE · Sapphire Sleet · Stardust Chollima
Reading and review
Records are auto-ingested and not human-reviewed. Confidence is the writer's 0–100 value; bands split at ≥80 / 50–79 / <50 into high / medium / low. The four trust axes (synthetic, lifecycle, band, source count) stay separate and never merge into one score.