Pearl Sleet

Executive Summary

Pearl Sleet (DEV-0215, LAWRENCIUM) is a North Korea-based cyber espionage group targeting defectors and media organizations. They have been active since at least 2012, focusing on intelligence gathering likely linked to political or internal security objectives.

Goals & Targeting

Pearl Sleet targets defectors and media organizations to gather intelligence that could be used for political manipulation or national security in North Korea. Their targeting strategy reflects a focus on sectors likely to hold sensitive information regarding the regime or its citizens.

Pearl Sleet is a nation-state activity group attributed to North Korea, operating since 2012. Their primary targets include defectors from North Korea and media organizations, suggesting a focus on cyber espionage. The group's activities aim to gather sensitive information, possibly for political purposes such as monitoring internal dissent or influencing external narratives about North Korea.

Key Capabilities

• Spear phishing attacks
• Malware development/deployment
• Data exfiltration
• C2 infrastructure management

MITRE ATT&CK Tactics

Software / Tooling

Campaigns & Victims

Pearl Sleet has conducted long-term campaigns targeting specific individuals and organizations. Their operations suggest a focus on maintaining persistence and secrecy, aligning with typical nation-state espionage tactics.

IOC Patterns

• Spear-phishing emails targeting defectors
• Malware embedded in malicious attachments or links
• C2 infrastructure communication patterns

Recommended Actions

• Implement advanced email filtering solutions to detect spear-phishing attempts.
• Monitor for unusual network activity indicative of persistent threats.
• Conduct regular security training on recognizing phishing emails.
• Segment networks and apply least privilege principles to mitigate lateral movement.

Suggested Tags