🐎🇰🇵 APT43

Crowdstrike: Velvet Chollima Cause: North Korean 🇰🇵 government support. Main targets: the US 🇺🇸, South Korea 🇰🇷 government organisations, and those who research Korean peninsula geopolitics. Main intent: Espionage and intel collection against 🇰🇷 South Korea

Key characteristics

Heavily rely on social engineering - no evidence of 0-day exploits. With NK groups, it’s harder to untangle them from each other. It is sometimes referred to as Kimsuky. This group strongly allied with the regime’s interests, mainly focusing on its nuclear program.

Malware: CobraVenom and Babyshark.

Affiliates

Lazarus. Possibly, other more minor actors in NK.

References