ID | Votes | Profile Description |
---|---|---|
Reconnaissance General Bureau | 6 | The Reconnaissance General Bureau (RGB) is a North Korean intelligence agency responsible for clandestine operations abroad, and it is believed to coordinate the nation's cyber activities. The RGB has been linked to several advanced persistent threat (APT) groups, including BeagleBoyz, Kimsuky, Anda |
Lazarus Group | 5 | The Lazarus Group, a notorious threat actor associated with North Korea, has been implicated in several high-profile cyber attacks and exploitation activities. The group's objective often involves establishing a kernel read/write primitive, which allows them to gain high-level access to systems and |
Rgb | 5 | RGB is a threat actor group associated with North Korea's Reconnaissance General Bureau (RGB), which has been involved in numerous cyber espionage activities. The RGB 3rd Bureau, based in Pyongyang and Sinuiju, includes state-sponsored cyber groups known as Andariel, Onyx Sleet (formerly PLUTONIUM), |
Onyx Sleet | 5 | Onyx Sleet, also known as Andariel, DarkSeoul, Silent Chollima, and Stonefly/Clasiopa, is a threat actor associated with North Korea's state-sponsored cyber operations. This group operates under the Democratic People’s Republic of Korea (DPRK)’s Reconnaissance General Bureau (RGB) 3rd Bureau, based |
Stonefly | 4 | The Andariel APT (also known as Stonefly, Silent Chollima, and Onyx Sleet) is a threat actor believed to be associated with the North Korean government. Active since at least 2015, it has been implicated in several cyber attacks, notably using ransomware campaigns to target US Healthcare and Public |
Reconnaissance General Bureau Rgb | 3 | The Reconnaissance General Bureau (RGB) is a North Korean threat actor, responsible for executing actions with malicious intent. It's associated with several hacking groups known within the global cybersecurity industry as Lazarus Group, Bluenoroff, and Andariel, which have been identified as agenci |
Silent Chollima | 3 | Silent Chollima, a North Korea-nexus threat actor, is known for its malicious cyber activities. The group, which is part of the 3rd Bureau of the Foreign Intelligence and Reconnaissance General Bureau, North Korea's foreign intelligence agency, has been associated with other groups such as Lazarus, |
APT38 | 2 | APT38, also known as TA444, BlueNoroff, BlackAlicanto, Coperenicum, Sapphire Sleet, and Stardust Chollima, is a North Korea-linked advanced persistent threat (APT) group. It has conducted operations in over 16 organizations across at least 11 countries, primarily targeting financial institutions wor |
Bluenoroff | 2 | BlueNoroff, a threat actor closely associated with the notorious Lazarus Group, has been actively involved in malicious cyber activities primarily targeting financial institutions and cryptocurrency businesses. Known for its sophisticated attacks on banks, casinos, fintech companies, POST software, |
ZINC | 2 | Zinc, also known as Diamond Sleet, is a North Korea-based threat actor group that has been actively involved in cyberattacks on global media, defense, and IT industries. Microsoft's Threat Intelligence Center has been tracking the group's activities, which have included weaponizing open-source softw |
Plutonium | 2 | Plutonium, a threat actor with potentially global implications, has been involved in several critical incidents. The group's activities have been traced back to the 1960s when alleged Israeli scientists visited NUMEC, claiming to obtain plutonium-238 for non-nuclear projects. The lack of stringent r |
ID | Type | Votes | Profile Description |
---|---|---|---|
Earlyrat | Unspecified | 2 | EarlyRat is a previously undocumented malware discovered by Kaspersky researchers in June. The North Korea-linked Advanced Persistent Threat (APT) group Andariel used EarlyRat in attacks exploiting the Log4j Log4Shell vulnerability last year. The malware was first noticed in one of the Log4j cases, |
Collectionrat | Unspecified | 2 | CollectionRAT is a newly identified malware, discovered by cybersecurity researchers who traced its origins through reused infrastructure components. This malicious software, short for Malware, is designed to exploit and damage computers or devices, often infiltrating systems via suspicious download |
Ninerat | Unspecified | 2 | NineRAT is a malicious software, or malware, that was first built in May 2022 and initially used in the Operation Blacksmith campaign against a South American agricultural organization in March. It is one of two Remote Access Trojans (RATs) utilized by Lazarus, a notorious Advanced Persistent Threat |
ID | Type | Votes | Profile Description |
---|---|---|---|
Kimsuky | Unspecified | 5 | Kimsuky, also known as Springtail, ARCHIPELAGO, Black Banshee, Thallium, Velvet Chollima, and APT43, is a North Korea-linked threat actor first identified by a Kaspersky researcher in 2013. This cyberespionage group has been associated with various malicious activities, including spear-phishing camp |
temp.hermit | Unspecified | 2 | Temp.Hermit, also known as Lazarus Group or Hidden Cobra, is a threat actor group associated with North Korea's Reconnaissance General Bureau (RGB). The group has been operational since 2013 and is known for its cyberespionage activities targeting governments and sectors such as defense, telecommuni |
ID | Type | Votes | Profile Description |
---|---|---|---|
Log4Shell | Unspecified | 4 | Log4Shell is a significant software vulnerability that exists within the Log4j Java-based logging utility. The vulnerability, officially designated as CVE-2021-44228, allows potential attackers to execute arbitrary code on targeted systems. Advanced Persistent Threat (APT) actors, including LockBit |
CVE-2023-42793 | Unspecified | 4 | CVE-2023-42793 is a critical security vulnerability identified in JetBrains TeamCity build management and continuous integration server. This flaw, characterized by an authentication bypass, was exploited by multiple threat actors throughout 2023 and into 2024. The first notable exploitation occurre |
Preview | Source Link | CreatedAt | Title |
---|---|---|---|
InfoSecurity-magazine | a month ago | South Korea Warns Pyongyang Has Stolen Spy Plane Details | |
Securityaffairs | a month ago | North Korea-linked hackers target construction and machinery sectors with watering hole and supply chain attacks | |
DARKReading | a month ago | Feds Warn of North Korean Cyberattacks on US Critical Infrastructure | |
DARKReading | a month ago | US Offers $10M Reward for Information on North Korean Hacker | |
Flashpoint | a month ago | COURT DOC: North Korean Government Hacker Charged for Involvement in Ransomware Attacks Targeting U.S. Hospitals and Health Care Providers | |
CISA | a month ago | North Korea Cyber Group Conducts Global Espionage Campaign to Advance Regime’s Military and Nuclear Programs | CISA | |
CISA | a month ago | FBI, CISA, and Partners Release Advisory Highlighting North Korean Cyber Espionage Activity | CISA | |
DARKReading | 3 months ago | LilacSquid APT Employs Open Source Tools, QuasarRAT | |
Securityaffairs | 3 months ago | LilacSquid APT targeted orgs in the U.S., Europe, and Asia | |
Securelist | 4 months ago | APT trends report Q1 2024 – Securelist | |
Checkpoint | 4 months ago | 29th April – Threat Intelligence Report - Check Point Research | |
DARKReading | 4 months ago | 3 DPRK APTs Spied on South Korea Defense Industry | |
InfoSecurity-magazine | 4 months ago | North Korean Hackers Target Dozens of Defense Companies | |
Securityaffairs | 4 months ago | North Korea-linked APT groups target South Korean defense contractors | |
CERT-EU | 6 months ago | Critical JetBrains TeamCity flaws come under active attacks | |
CERT-EU | 6 months ago | JetBrain urges to fix critical TeamCity On-Premises vulnerabilities | |
CERT-EU | 8 months ago | Cyber Security Week In Review: December 29, 2023 | |
CERT-EU | 9 months ago | Apache ActiveMQ Vulnerability: The Threat That Cannot Be Ignored | |
DARKReading | 9 months ago | Global TeamCity Exploitation Opens Door to SolarWinds-Style Nightmare | |
BankInfoSecurity | 9 months ago | Lazarus Exploits Log4Shell to Deploy Telegram-Based Malware |