Threat Actors Andariel

Andariel

G0138 TLP:CLEAR

Active

Kill Chain Analysis Generate Graph Hunt Package

Also known as: Silent Chollima, PLUTONIUM, Onyx Sleet, Andariel, OperationTroy, Guardian of Peace, GOP, WHOis Team, Subgroup: Andariel, Jumpy Pisces, APT38, tracked as, North Korea, North Korean

Description

Andariel is a North Korean state-sponsored threat group that has been active since at least 2009. Andariel has primarily focused its operations--which have included destructive attacks--against South Korean government agencies, military organizations, and a variety of domestic companies; they have also conducted cyber financial operations against ATMs, banks, and cryptocurrency exchanges. Andariel's notable activity includes Operation Black Mine, Operation GoldenAxe, and Campaign Rifle.(Citation: FSI Andariel Campaign Rifle July 2017)(Citation: IssueMakersLab Andariel GoldenAxe May 2017)(Citation: AhnLab Andariel Subgroup of Lazarus June 2018)(Citation: TrendMicro New Andariel Tactics July 2018)(Citation: CrowdStrike Silent Chollima Adversary September 2021) Andariel is considered a sub-set of Lazarus Group, and has been attributed to North Korea's Reconnaissance General Bureau.(Citation: Treasury North Korean Cyber Groups September 2019) North Korean group definitions are known to have significant overlap, and some security researchers report all North Korean state-sponsored cyber activity under the name Lazarus Group instead of tracking clusters or subgroups.

Goals & Targeting

Targeted Sectors

Defense

Government

Financial services

Nuclear

Manufacturing

Aerospace

Healthcare

Critical infrastructure

Gaming

Transportation

Education

Energy

Maritime

Think tank

Targeted Countries / Regions

AI Analysis

· 1 week ago

Executive Summary

Andariel is a North Korean state-sponsored threat group linked to the Lazarus Group, primarily targeting South Korean government agencies, military organizations, and financial sectors. Known for destructive cyberattacks and cyber financial operations, Andariel has been active since at least 2009 and remains a significant espionage threat.

Goals & Targeting

Andariel's primary strategic objectives appear to be espionage and disruption of South Korean political and military infrastructure. The group targets specific sectors due to their alignment with North Korea's geopolitical interests, including gathering sensitive information and destabilizing South Korean institutions. Typical victims include government agencies, defense contractors, financial institutions, and critical infrastructure organizations in South Korea.

Enhanced Description

Andariel is a highly sophisticated North Korean state-sponsored cyber threat group that operates under the umbrella of the Lazarus Group. The group primarily focuses on South Korean government agencies, military organizations, and financial institutions, including banks, ATMs, and cryptocurrency exchanges. Andariel has been involved in notable operations such as Operation Black Mine, Operation GoldenAxe, and Campaign Rifle, which demonstrate its capability to execute large-scale, destructive cyberattacks. The group is known for its use of advanced persistent threat (APT) tactics and tools, including malware deployment and phishing attacks. Despite being a subgroup of Lazarus, Andariel has distinct operational patterns and campaigns that set it apart from the broader Lazarus activities.

Key Capabilities

Advanced persistent threat (APT) tactics
Destructive cyberattacks
Cyber financial operations targeting ATMs, banks, and cryptocurrency exchanges
Use of custom malware and remote access tools (RATs)
Spear-phishing campaigns with malicious file attachments
Exploitation of vulnerabilities for client execution
Steganography techniques to hide data within images

MITRE ATT&CK Tactics

Reconnaissance

Collection

Exfiltration

Impact

Validation Techniques

Defense-Evasion

Discovery

ATT&CK Techniques

T1059.003

T1055

T1566.001

T1005

T1588.001

T1203

T1027.003

Software / Tooling

gh0st RAT

Rifdoor

Custom malware frameworks

Campaigns & Victims

Andariel has demonstrated a persistent and targeted approach, with campaigns such as Operation Black Mine and Operation GoldenAxe highlighting its ability to infiltrate critical infrastructure. The group's operational tempo appears to align with North Korea's geopolitical strategy, focusing on long-term intelligence gathering and occasional high-impact destructive attacks. Notable past operations include the 2017 WannaCry-like ransomware attack on South Korean organizations, further solidifying Andariel's reputation as a formidable threat actor.

IOC Patterns

Spear-phishing emails with malicious file attachments
Use of custom malware and remote access tools (RATs)
Steganography to hide data within images
Exploitation of vulnerabilities in client-side applications

Recommended Actions

Implement robust email filtering and phishing detection mechanisms.
Conduct regular endpoint detection and response (EDR) scans for signs of RAT activity.
Monitor network traffic for unusual patterns linked to Andariel TTPs.
Enhance incident response capabilities to address potential destructive attacks.
Educate employees on identifying spear-phishing attempts and suspicious emails.

Suggested Tags

APT

Nation-state

South Korea

Financial sector

Espionage

Confidence Assessment

Confidence in Andariel's details is high due to multiple credible sources linking the group to North Korea and Lazarus activities. However, some information gaps exist regarding exact timelines of their first seen activity and specific goals beyond espionage. Additionally, the overlap with Lazarus Group may complicate precise attribution in some cases.

ATT&CK Techniques

Collection

1 technique

T1005

Data from Local System

Andariel has collected large numbers of files from compromised network systems for later extraction.(Citation: FSI Andariel Campaign Rifle July 2017)

Command & Control

1 technique

T1105

Ingress Tool Transfer

Andariel has downloaded additional tools and malware onto compromised hosts.(Citation: AhnLab Andariel Subgroup of Lazarus June 2018)

Discovery

2 techniques

T1049

System Network Connections Discovery

Andariel has used the <code>netstat -naop tcp</code> command to display TCP connections on a victim's machine.(Citation: Kaspersky Andariel Ransomware June 2021)

T1057

Process Discovery

Andariel has used <code>tasklist</code> to enumerate processes and find a specific string.(Citation: Kaspersky Andariel Ransomware June 2021)

Execution

3 techniques

T1203

Exploitation for Client Execution

Andariel has exploited numerous ActiveX vulnerabilities, including zero-days.(Citation: FSI Andariel Campaign Rifle July 2017)(Citation: IssueMakersLab Andariel GoldenAxe May 2017)(Citation: TrendMicro New Andariel Tactics July 2018)

T1204

User Execution

T1204.002

Malicious File

Andariel has attempted to lure victims into enabling malicious macros within email attachments.(Citation: AhnLab Andariel Subgroup of Lazarus June 2018)

Initial Access

3 techniques

T1189

Drive-by Compromise

Andariel has used watering hole attacks, often with zero-day exploits, to gain initial access to victims within a specific IP range.(Citation: AhnLab Andariel Subgroup of Lazarus June 2018)(Citation: TrendMicro New Andariel Tactics July 2018)

T1566

Phishing

T1566.001

Spearphishing Attachment

Andariel has conducted spearphishing campaigns that included malicious Word or Excel attachments.(Citation: AhnLab Andariel Subgroup of Lazarus June 2018)(Citation: MalwareBytes Lazarus-Andariel Conceals Code April 2021)

Reconnaissance

4 techniques

T1590

Gather Victim Network Information

T1590.005

IP Addresses

Andariel has limited its watering hole attacks to specific IP address ranges.(Citation: AhnLab Andariel Subgroup of Lazarus June 2018)

T1592

Gather Victim Host Information

T1592.002

Software

Andariel has inserted a malicious script within compromised websites to collect potential victim information such as browser type, system language, Flash Player version, and other data.(Citation: TrendMicro New Andariel Tactics July 2018)

Resource Development

2 techniques

T1588

Obtain Capabilities

T1588.001

Malware

Andariel has used a variety of publicly-available remote access Trojans (RATs) for its operations.(Citation: FSI Andariel Campaign Rifle July 2017)

Stealth

2 techniques

T1027

Obfuscated Files or Information

T1027.003

Steganography

Andariel has hidden malicious executables within PNG files.(Citation: MalwareBytes Lazarus-Andariel Conceals Code April 2021)(Citation: Kaspersky Andariel Ransomware June 2021)

Software / Tooling

S0045

ADVSTORESHELL

Andariel

Description

Goals & Targeting

AI Analysis

ATT&CK Techniques

Software / Tooling

Campaigns / Victims

Observed Data

Indicators of Compromise

References

Intel Summary

Tags

Details