APT38 is a North Korean state-sponsored threat group that specializes in financial cyber operations; it has been attributed to the Reconnaissance General Bureau.1 Active since at least 2014, APT38 has targeted banks, financial institutions, casinos, cryptocurrency exchanges, SWIFT system endpoints, and ATMs in at least 38 countries worldwide. Significant operations include the 2016 Bank of Bangladesh heist, Bancomext 2 and Banco de Chile 3, along with software supply chain compromises and destructive malware attacks.45678910 North Korean group definitions are known to have significant overlap, and some security researchers report all North Korean state-sponsored cyber activity under the name Lazarus Group instead of tracking clusters or subgroups.
- CISA AA20-239A BeagleBoyz August 2020
- FireEye APT38 Oct 2018
- FireEye APT38 Oct 2018
- CISA AA20-239A BeagleBoyz August 2020
- FireEye APT38 Oct 2018
- DOJ North Korea Indictment Feb 2021
- Kaspersky Lazarus Under The Hood Blog 2017
- Microsoft Axios Compromise APR 2026
- Microsoft Sapphire Sleet APR 2026
- MIcrosoft Mastra npm Compromise JUN 2026
断言与引用
每条断言来自写入方；provenance 是写入方声称，不是本目录的复核结论。有效期按引用年份读取。
| predicate | object | 有效期 | 置信 | 证据 |
|---|---|---|---|---|
| uses_technique | tech_t1486 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1055 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1033 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1657 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1112 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1036.005 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1677 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1049 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1070.004 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1036.006 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1608.001 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1056.001 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1056.002 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1518.001 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1543.003 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1564.011 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1213.006 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1548.002 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1678 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1189 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1683.002 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1053.006 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1083 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1213.005 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1070.003 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.003 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1140 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.002 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1685.003 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1585.002 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.005 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1074.001 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1585.001 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1027.015 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1529 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1204.001 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1071.001 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1105 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1685 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1583.006 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1012 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1027.002 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1217 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1685.005 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1684.001 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1566.003 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.006 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1543.001 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1218.005 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1070.006 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1686 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1480 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1583.003 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1485 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1110 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1124 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.004 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1135 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1553.005 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1567 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1082 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1195.001 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1132.001 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1565.002 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1041 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1686.002 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1561.002 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1036.003 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1690 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1036.008 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1053.005 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1552.004 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1588.002 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1505.003 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1552.003 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1115 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1555.003 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1586.003 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1548.003 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1555.001 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1620 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.007 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1218.011 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1565.003 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1583.001 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1548.006 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1106 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1218.001 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1547.001 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1204.002 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1555 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1565.001 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1078.004 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1543.004 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1005 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1564.003 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.001 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1027.010 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1053.003 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1566.001 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1566.002 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1218.007 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1078.003 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1683.001 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1027.016 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1571 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1518 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1048.002 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1569.002 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1222.002 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1480.002 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1057 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1546.016 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1564.012 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1560.001 | 2019 → … | 100 | src_mitre_attck_enterprise |
技术使用
| ATT&CK | 技术 | platforms |
|---|---|---|
| T1005 | Data from Local System | — |
| T1012 | Query Registry | — |
| T1027.002 | Software Packing | — |
| T1027.010 | Command Obfuscation | — |
| T1027.015 | Compression | — |
| T1027.016 | Junk Code Insertion | — |
| T1033 | System Owner/User Discovery | — |
| T1036.003 | Rename Legitimate Utilities | — |
| T1036.005 | Match Legitimate Resource Name or Location | — |
| T1036.006 | Space after Filename | — |
| T1036.008 | Masquerade File Type | — |
| T1041 | Exfiltration Over C2 Channel | — |
| T1048.002 | Exfiltration Over Asymmetric Encrypted Non-C2 Protocol | — |
| T1049 | System Network Connections Discovery | — |
| T1053.003 | Cron | — |
| T1053.005 | Scheduled Task | — |
| T1053.006 | Systemd Timers | — |
| T1055 | Process Injection | — |
| T1056.001 | Keylogging | — |
| T1056.002 | GUI Input Capture | — |
| T1057 | Process Discovery | — |
| T1059.001 | PowerShell | — |
| T1059.002 | AppleScript | — |
| T1059.003 | Windows Command Shell | — |
| T1059.004 | Unix Shell | — |
| T1059.005 | Visual Basic | — |
| T1059.006 | Python | — |
| T1059.007 | JavaScript | — |
| T1070.003 | Clear Command History | — |
| T1070.004 | File Deletion | — |
| T1070.006 | Timestomp | — |
| T1071.001 | Web Protocols | — |
| T1074.001 | Local Data Staging | — |
| T1078.003 | Local Accounts | — |
| T1078.004 | Cloud Accounts | — |
| T1082 | System Information Discovery | — |
| T1083 | File and Directory Discovery | — |
| T1105 | Ingress Tool Transfer | — |
| T1106 | Native API | — |
| T1110 | Brute Force | — |
| T1112 | Modify Registry | — |
| T1115 | Clipboard Data | — |
| T1124 | System Time Discovery | — |
| T1132.001 | Standard Encoding | — |
| T1135 | Network Share Discovery | — |
| T1140 | Deobfuscate/Decode Files or Information | — |
| T1189 | Drive-by Compromise | — |
| T1195.001 | Compromise Software Dependencies and Development Tools | — |
| T1204.001 | Malicious Link | — |
| T1204.002 | Malicious File | — |
| T1213.005 | Messaging Applications | — |
| T1213.006 | Databases | — |
| T1217 | Browser Information Discovery | — |
| T1218.001 | Compiled HTML File | — |
| T1218.005 | Mshta | — |
| T1218.007 | Msiexec | — |
| T1218.011 | Rundll32 | — |
| T1222.002 | Linux and Mac Permissions | — |
| T1480 | Execution Guardrails | — |
| T1480.002 | Mutual Exclusion | — |
| T1485 | Data Destruction | — |
| T1486 | Data Encrypted for Impact | — |
| T1505.003 | Web Shell | — |
| T1518 | Software Discovery | — |
| T1518.001 | Security Software Discovery | — |
| T1529 | System Shutdown/Reboot | — |
| T1543.001 | Launch Agent | — |
| T1543.003 | Windows Service | — |
| T1543.004 | Launch Daemon | — |
| T1546.016 | Installer Packages | — |
| T1547.001 | Registry Run Keys / Startup Folder | — |
| T1548.002 | Bypass User Account Control | — |
| T1548.003 | Sudo and Sudo Caching | — |
| T1548.006 | TCC Manipulation | — |
| T1552.003 | Shell History | — |
| T1552.004 | Private Keys | — |
| T1553.005 | Mark-of-the-Web Bypass | — |
| T1555 | Credentials from Password Stores | — |
| T1555.001 | Keychain | — |
| T1555.003 | Credentials from Web Browsers | — |
| T1560.001 | Archive via Utility | — |
| T1561.002 | Disk Structure Wipe | — |
| T1564.003 | Hidden Window | — |
| T1564.011 | Ignore Process Interrupts | — |
| T1564.012 | File/Path Exclusions | — |
| T1565.001 | Stored Data Manipulation | — |
| T1565.002 | Transmitted Data Manipulation | — |
| T1565.003 | Runtime Data Manipulation | — |
| T1566.001 | Spearphishing Attachment | — |
| T1566.002 | Spearphishing Link | — |
| T1566.003 | Spearphishing via Service | — |
| T1567 | Exfiltration Over Web Service | — |
| T1569.002 | Service Execution | — |
| T1571 | Non-Standard Port | — |
| T1583.001 | Domains | — |
| T1583.003 | Virtual Private Server | — |
| T1583.006 | Web Services | — |
| T1585.001 | Social Media Accounts | — |
| T1585.002 | Email Accounts | — |
| T1586.003 | Cloud Accounts | — |
| T1588.002 | Tool | — |
| T1608.001 | Upload Malware | — |
| T1620 | Reflective Code Loading | — |
| T1657 | Financial Theft | — |
| T1677 | Poisoned Pipeline Execution | — |
| T1678 | Delay Execution | — |
| T1683.001 | Written Content | — |
| T1683.002 | Audio-Visual Content | — |
| T1684.001 | Impersonation | — |
| T1685 | Disable or Modify Tools | — |
| T1685.003 | Modify or Spoof Tool UI | — |
| T1685.005 | Clear Windows Event Logs | — |
| T1686 | Disable or Modify System Firewall | — |
| T1686.002 | Network Device Firewall | — |
| T1690 | Prevent Command History Logging | — |
别名
APT38 · BeagleBoyz · Bluenoroff · COPERNICIUM · NICKEL GLADSTONE · Sapphire Sleet · Stardust Chollima
读取与复核
记录自动入库·未人工复核。置信度是写入方给出的 0–100 值，置信带按 ≥80 / 50–79 / <50 划为高 / 中 / 低；四条信任轴（合成、生命周期、置信带、佐证源数）分开呈现，不合并为单一信任分。