Apt45

APT45, also known as Andariel, Onyx Sleet, and Silent Chollima, is a North Korean threat actor associated with the Reconnaissance General Bureau, a military intelligence agency. This group has been operational since at least 2009, making it one of North Korea's longest-running cyber operators. Their activities reflect North Korea's geopolitical priorities, initially focusing on cyber espionage against government and defense entities but have expanded to include targets in healthcare and crop science sectors. The group's operations have evolved over time, shifting from traditional cyber espionage to more financially motivated attacks such as ransomware. The group has been implicated in a series of global cyberattacks, using laundered ransom payments to purchase internet infrastructure for hacking purposes. These funds were reportedly funneled through China-based facilitators. According to court documents, Rim and his co-conspirators within APT45 used this infrastructure to exfiltrate sensitive defense and technology information from entities across the globe. Despite these activities being known to authorities, the group continues its operations. Recently, the U.S. Department of Justice indicted members of APT45, also known as the Stonefly group, for their ongoing financially motivated cyberattacks against U.S. organizations. However, despite this legal action, researchers at Google's Mandiant have observed that the group continues its activities unabated. Mandiant reports indicate an increase in financially motivated attacks, including ransomware, even as the group maintains its cyber espionage mission.