APT38

APT38, a threat actor suspected to be backed by the North Korean regime, has been responsible for some of the largest cyber heists observed to date. The group has conducted operations in over 16 organizations across at least 11 countries, primarily targeting financial institutions worldwide. Despite sharing malware development resources and state sponsorship with another North Korean group known as "Lazarus," APT38 distinguishes itself through its unique toolset, tactics, techniques, and procedures (TTPs), and its financial motivation. Notably, APT38 has used ransomware such as Ryuk and Hermes in its operations. In June 2022, APT38, in conjunction with the Lazarus Group, stole $100 million worth of cryptocurrency assets from the Blockchain company Harmony Horizon Bridge. This theft was confirmed by the U.S. Federal Bureau of Investigation (FBI) in January 2023. The group overlaps with other groups tracked by the cybersecurity industry, including Lazarus, Bluenoroff, Stardust Chollima, and BeagleBoyz, the latter being responsible for the FASTCash ATM cash outs reported in October 2018 and fraudulent abuse of compromised bank-operated SWIFT system endpoints since at least 2015. APT38, also known as Alluring Pisces, BlueNoroff, Sapphire Sleet, and TA444 among others, has targeted not just financial institutions but also cryptocurrency businesses and ATMs. Other groups like CryptoCore and TraderTraitor, active since at least 2018, focus on cryptocurrency theft and may be successors to APT38. Although no recent attacks have been attributed to APT38, historically, it has focused on financial theft, including stealing millions of dollars by targeting Interbank Fund Transfer Systems.