Onyx Sleet

Onyx Sleet, also known as Andariel, Silent Chollima, and Stonefly, is a North Korean state-sponsored cyber group under the RGB 3rd Bureau. This threat actor utilizes an array of malware to gather intelligence for North Korea, primarily conducting cyberespionage, but also engaging in ransomware activities. The group has consistently used the same tactics, techniques, and procedures (TTPs) over extended periods, suggesting their tradecraft is effective. Notably, Onyx Sleet has recently shifted from spear-phishing to exploiting vulnerabilities for initial access, highlighting their adaptability. In October 2023, researchers at Microsoft revealed that North Korean nation-state threat actors, including Onyx Sleet, were exploiting a remote code execution vulnerability affecting multiple versions of the JetBrains TeamCity server. This exploit, tracked as CVE-2023-42793, allowed the threat actors to gain administrative control of servers. This marked a significant escalation in their activities, demonstrating their ability to exploit critical infrastructure vulnerabilities. Despite facing an indictment and a $10 million bounty from the US Department of Justice, Onyx Sleet continues its operations unabated. They have been involved in ransomware attacks on US healthcare entities, ostensibly to fund their campaigns. Entities associated with various industries are advised to remain vigilant in defending their networks from these state-sponsored cyber operations. The persistent and evolving threat posed by Onyx Sleet underscores the need for robust cybersecurity measures and constant vigilance.