Andariel

Also known as: Andariel, GOP, Guardian of Peace, Onyx Sleet, OperationTroy, PLUTONIUM, Silent Chollima, Subgroup: Andariel, WHOis Team

Andariel is a North Korean state-sponsored threat group that has been active since at least 2009. Andariel has primarily focused its operations–which have included destructive attacks–against South Korean government agencies, military organizations, and a variety of domestic companies; they have also conducted cyber financial operations against ATMs, banks, and cryptocurrency exchanges. Andariel’s notable activity includes Operation Black Mine, Operation GoldenAxe, and Campaign Rifle. FSI Andariel Campaign Rifle July 2017 IssueMakersLab Andariel GoldenAxe May 2017 AhnLab Andariel Subgroup of Lazarus June 2018 TrendMicro New Andariel Tactics July 2018 CrowdStrike Silent Chollima Adversary September 2021

Andariel is considered a sub-set of Lazarus Group, and has been attributed to North Korea’s Reconnaissance General Bureau. Treasury North Korean Cyber Groups September 2019

North Korean group definitions are known to have significant overlap, and some security researchers report all North Korean state-sponsored cyber activity under the name Lazarus Group instead of tracking clusters or subgroups.

🌍 Country North Korea
🧭 ATT&CK G0138

Introduction

Andariel is a North Korean state-sponsored threat group that has been active since at least 2009. Andariel has primarily focused its operations–which have included destructive attacks–against South Korean government agencies, military organizations, and a variety of domestic companies; they have also conducted cyber financial operations against ATMs, banks, and cryptocurrency exchanges. Andariel’s notable activity includes Operation Black Mine, Operation GoldenAxe, and Campaign Rifle. FSI Andariel Campaign Rifle July 2017 IssueMakersLab Andariel GoldenAxe May 2017 AhnLab Andariel Subgroup of Lazarus June 2018 TrendMicro New Andariel Tactics July 2018 CrowdStrike Silent Chollima Adversary September 2021 Andariel is considered a sub-set of Lazarus Group, and has been attributed to North Korea’s Reconnaissance General Bureau. Treasury North Korean Cyber Groups September 2019 North Korean group definitions are known to have significant overlap, and some security researchers report all North Korean state-sponsored cyber activity under the name Lazarus Group instead of tracking clusters or subgroups.

Activities and Tactics

Country of Origin: 🇰🇵 North Korea

Notable Campaigns

Information pending cataloguing.

Tactics, Techniques, and Procedures (TTPs)

ATT&CK technique IDs (denormalized)

Notable Indicators of Compromise (IOCs)

No curated IOCs are currently published for this actor. This section will be updated when stable, attributable indicators are available.

Malware and Tools

MITRE ATT&CK Software

Attribution and Evidence

Country of Origin: North Korea Additional attribution information pending cataloguing.

References

[1] mitre-attack [6] AhnLab Andariel Subgroup of Lazarus June 2018 AhnLab. (2018, June 23). Targeted attacks by Andariel Threat Group, a subgroup of the Lazarus. Retrieved September 29, 2021. [7] TrendMicro New Andariel Tactics July 2018 Chen, Joseph. (2018, July 16). New Andariel Reconnaissance Tactics Uncovered. Retrieved September 29, 2021. [8] CrowdStrike Silent Chollima Adversary September 2021 CrowdStrike. (2021, September 29). Silent Chollima Adversary Profile. Retrieved September 29, 2021. [9] FSI Andariel Campaign Rifle July 2017 FSI. (2017, July 27). Campaign Rifle - Andariel, the Maiden of Anguish. Retrieved September 12, 2024. [10] IssueMakersLab Andariel GoldenAxe May 2017 IssueMakersLab. (2017, May 1). Operation GoldenAxe. Retrieved September 12, 2024. [11] Microsoft Threat Actor Naming July 2023 Microsoft . (2023, July 12). How Microsoft names threat actors. Retrieved November 17, 2023. [12] Treasury North Korean Cyber Groups September 2019 US Treasury . (2019, September 13). Treasury Sanctions North Korean State-Sponsored Malicious Cyber Groups. Retrieved September 29, 2021.