APT38

APT38, also known as TA444, BlueNoroff, BlackAlicanto, Coperenicum, Sapphire Sleet, and Stardust Chollima, is a North Korea-linked advanced persistent threat (APT) group. It has conducted operations in over 16 organizations across at least 11 countries, primarily targeting financial institutions worldwide. This group has been responsible for some of the largest cyber heists observed to date. Although APT38 shares malware development resources and North Korean state sponsorship with Lazarus Group, they are distinct due to their unique toolset, tactics, techniques, and procedures (TTPs), and their financial motivation. The cybersecurity community has found code similarities between Ryuk and Hermes, a ransomware used by APT38, driving a narrative that links the two. The group overlaps with other groups like BeagleBoyz, Bluenoroff, and Stardust Chollima, and has been involved in various illicit activities such as FASTCash ATM cash outs, fraudulent abuse of compromised bank-operated SWIFT system endpoints, and cryptocurrency thefts. Notably, in June 2022, APT38 was implicated in the theft of $100 million of virtual currency from Harmony’s Horizon Bridge, a fact later confirmed by the FBI in January 2023. It's worth noting that while APT38 has not been attributed with recent attacks, historically, it has focused on financial theft, including stealing millions of dollars by targeting Interbank Fund Transfer Systems. Some threat researchers suggest that groups like CryptoCore (UNC1069) and TraderTraitor (UNC4899), who also target blockchain companies, may be successors to APT38. Overall, APT38 remains a significant cybersecurity threat due to its sophisticated tactics and substantial financial impact.