Andariel

Andariel, also known as Jumpy Pisces and Onyx Sleet, is a threat actor primarily involved in cyberespionage and ransomware activities. Originating from North Korea, this group has been linked to several malicious cyber activities alongside other groups like Lazarus Group and Bluenoroff. The group's modus operandi includes exploiting vulnerabilities in server security products, domestic VPNs, and IT management software to distribute malware such as DoraRAT and gain high-level access and control over their targets. Their victims range from U.S. healthcare entities to critical national infrastructure organizations, with the intent to extract classified technical information and intellectual property. In recent years, Andariel has intensified its operations, often conducting ransomware attacks and cyber espionage on the same day or against the same entity. A notable instance occurred in April 2024, when the group exploited vulnerabilities to deliver remote control malware to construction and machinery companies. In addition to these activities, Andariel also funds its espionage activity through ransomware operations, particularly targeting U.S. healthcare entities. This dual approach of espionage and ransomware indicates a sophisticated and multifaceted threat strategy. The joint advisory from the UK, US, and South Korean governments has listed 41 Common Vulnerabilities and Exposures (CVEs) that Andariel actors have exploited as part of their cyberespionage campaign. Once they gain access to a network, the group uses a variety of custom tools and malware to establish remote access, enable lateral movement, and steal data. Despite the increasing awareness and protective measures taken by targeted entities, Andariel continues to employ the same tactics, techniques, and procedures (TTPs) over extended periods, indicating their confidence in the effectiveness of their tradecraft.