APT38

Also known as: APT38, BeagleBoyz, Bluenoroff, COPERNICIUM, NICKEL GLADSTONE, Sapphire Sleet, Stardust Chollima, STARDUST CHOLLIMA

APT38 is a North Korean state-sponsored threat group that specializes in financial cyber operations; it has been attributed to the Reconnaissance General Bureau. CISA AA20-239A BeagleBoyz August 2020 Active since at least 2014, APT38 has targeted banks, financial institutions, casinos, cryptocurrency exchanges, SWIFT system endpoints, and ATMs in at least 38 countries worldwide. Significant operations include the 2016 Bank of Bangladesh heist, during which APT38 stole $81 million, as well as attacks against Bancomext FireEye APT38 Oct 2018 and Banco de Chile FireEye APT38 Oct 2018; some of their attacks have been destructive. CISA AA20-239A BeagleBoyz August 2020 FireEye APT38 Oct 2018 DOJ North Korea Indictment Feb 2021 Kaspersky Lazarus Under The Hood Blog 2017

North Korean group definitions are known to have significant overlap, and some security researchers report all North Korean state-sponsored cyber activity under the name Lazarus Group instead of tracking clusters or subgroups.

🧭 ATT&CK G0082

Introduction

APT38 is a North Korean state-sponsored threat group that specializes in financial cyber operations; it has been attributed to the Reconnaissance General Bureau. CISA AA20-239A BeagleBoyz August 2020 Active since at least 2014, APT38 has targeted banks, financial institutions, casinos, cryptocurrency exchanges, SWIFT system endpoints, and ATMs in at least 38 countries worldwide. Significant operations include the 2016 Bank of Bangladesh heist, during which APT38 stole $81 million, as well as attacks against Bancomext FireEye APT38 Oct 2018 and Banco de Chile FireEye APT38 Oct 2018; some of their attacks have been destructive. CISA AA20-239A BeagleBoyz August 2020 FireEye APT38 Oct 2018 DOJ North Korea Indictment Feb 2021 Kaspersky Lazarus Under The Hood Blog 2017 North Korean group definitions are known to have significant overlap, and some security researchers report all North Korean state-sponsored cyber activity under the name Lazarus Group instead of tracking clusters or subgroups.

Activities and Tactics

Information pending cataloguing.

Notable Campaigns

Information pending cataloguing.

Tactics, Techniques, and Procedures (TTPs)

ATT&CK technique IDs (denormalized)

Notable Indicators of Compromise (IOCs)

No curated IOCs are currently published for this actor. This section will be updated when stable, attributable indicators are available.

Malware and Tools

MITRE ATT&CK Software

Attribution and Evidence

Information pending cataloguing.

References

[1] mitre-attack [9] CrowdStrike GTR 2021 June 2021 CrowdStrike. (2021, June 7). CrowdStrike 2021 Global Threat Report. Retrieved September 29, 2021. [10] DOJ North Korea Indictment Feb 2021 Department of Justice. (2021, February 17). Three North Korean Military Hackers Indicted in Wide-Ranging Scheme to Commit Cyberattacks and Financial Crimes Across the Globe. Retrieved June 9, 2021. [11] CISA AA20-239A BeagleBoyz August 2020 DHS/CISA. (2020, August 26). FASTCash 2.0: North Korea’s BeagleBoyz Robbing Banks. Retrieved September 29, 2021. [12] FireEye APT38 Oct 2018 FireEye. (2018, October 03). APT38: Un-usual Suspects. Retrieved November 17, 2024. [13] Kaspersky Lazarus Under The Hood Blog 2017 GReAT. (2017, April 3). Lazarus Under the Hood. Retrieved April 17, 2019. [14] CrowdStrike Stardust Chollima Profile April 2018 Meyers, Adam. (2018, April 6). Meet CrowdStrike’s Adversary of the Month for April: STARDUST CHOLLIMA. Retrieved September 29, 2021. [15] Microsoft Threat Actor Naming July 2023 Microsoft . (2023, July 12). How Microsoft names threat actors. Retrieved November 17, 2023. [16] Microsoft Axios Compromise APR 2026 Microsoft Threat Intelligence. (2026, April 1). Mitigating the Axios npm supply chain compromise. Retrieved September 30, 2026. [17] Microsoft Sapphire Sleet APR 2026 Microsoft Threat Intelligence. (2026, April 16). Dissecting Sapphire Sleet’s macOS intrusion from lure to compromise. Retrieved September 30, 2026. [18] MIcrosoft Mastra npm Compromise JUN 2026 Microsoft Threat Intelligence. (2026, June 17). From package to postinstall payload: Inside the Mastra npm supply chain compromise by Sapphire Sleet. Retrieved September 30, 2026. [19] SecureWorks NICKEL GLADSTONE profile Sept 2021 SecureWorks. (2021, September 29). NICKEL GLADSTONE Threat Profile. Retrieved September 29, 2021.