Andariel

Andariel, a threat actor controlled by North Korea's military intelligence agency, the Reconnaissance General Bureau, has been actively conducting cyber espionage and ransomware operations. The group funds its activities through ransomware attacks primarily targeting U.S. healthcare entities. In some instances, these attacks and espionage operations have occurred simultaneously, even against the same entity. Andariel deploys DTrack and Maui ransomware, with the latter having been active since at least 2022. The group has also attacked ActiveX objects and is known to leave tools in specific folders post-attack. The group's activities have not gone unnoticed. The US Department of State's Rewards for Justice (RFJ) program is offering up to $10 million for information leading to key Andariel members like Rim Jong Hyok. Researchers suggest that defenders use the latest threat intelligence to identify malware on networks and advanced URL filtering and DNS security products to detect known URLs and domains associated with Andariel's malicious activity. This advice comes as Andariel continues to target critical sectors such as defense, aerospace, nuclear, and engineering companies, as well as global managed service providers. There are signs of collaboration between Andariel and the Play ransomware group. For instance, the compromised account used for initial access and spreading of Andariel's signature tools, including Silver and Dtrack, was also used prior to Play ransomware deployment. After breaching networks, Andariel moves laterally and maintains persistence by spreading the open source tool Sliver and its unique custom malware, DTrack, to other hosts via the Server Message Block (SMB) protocol. Despite some mistakes made by the group, it remains a significant cybersecurity threat.