Onyx Sleet

Onyx Sleet, a threat actor also known as Andariel, Silent Chollima, and Stonefly, is a North Korean state-sponsored cyber group under the RGB 3rd Bureau. This group, based in Pyongyang and Sinuiju, has been associated with various malicious activities including cyber espionage and ransomware attacks. The U.S. Federal Bureau of Investigation (FBI), along with other authoring partners, released a cybersecurity advisory to highlight this activity, indicating that entities involved in certain industries should remain vigilant against these state-sponsored cyber operations. The group's tactics, techniques, and procedures (TTPs) have remained consistent over time, suggesting they view their tradecraft as effective. Onyx Sleet has exploited multiple well-known vulnerabilities to gain initial access to target networks. In October 2023, Microsoft's Threat Intelligence Center reported that Onyx Sleet, along with another North Korean threat actor Diamond Sleet, were exploiting a remote code execution vulnerability affecting multiple versions of the JetBrains TeamCity server (CVE-2023-42793). This allowed them to perform a remote code execution attack and gain administrative control of servers. In addition to its cyber espionage activities, Onyx Sleet has also engaged in ransomware attacks on U.S. healthcare entities to fund its operations. Despite an indictment and a $10 million bounty from the U.S. Department of Justice, researchers at Symantec's Threat Hunter Team reported that Onyx Sleet continues its activities, likely to generate funds for the Kim Jong-Un regime. Microsoft observed a recent shift in Onyx Sleet's strategy, moving from spear-phishing to using vulnerability exploits to gain initial access.