Andariel (89)
Events whose actors field, as written by the source, names this.
| Date (as written) | Incident | Country | Actors |
|---|---|---|---|
| 2016-08 | Defense Network | Korea, Republic of | Andariel |
| 2016-05 | SK/Hanjin | Korea, Republic of | Andariel |
| 2016-04 | DSME#1 | Korea, Republic of | Andariel |
| 2016-03 | Interpark | Korea, Republic of | Andariel |
| 2016-01 | Initech | Korea, Republic of | Andariel |
| 9/1/2016 | Anderial | N Korea / S Korea | |
| 2017-09 | Hanatour | Korea, Republic of | Andariel |
| 2017-05 | Labor Unions | Korea, Republic of | Andariel |
| 2017-03 | Chongho Easycash | Korea, Republic of | Andariel |
| 2017-07-15 | 2017 Cryptojacking Incidents | ||
| 2018-05 | Sejong Institue | Korea, Republic of | Andariel |
| 01.06.2018 | Andariel Group attacks website of South Korean non-profit organisation | Korea, Republic of;Korea, Republic of | Andariel/APT45/Onyx Sleet fka PLUTONIUM/Silent Chollima/Stonefly/G0138/DarkSeoul < Lazarus Group/Labyrinth Chollima/HIDDEN COBRA/Guardians of Peace/Diamond Sleet fka ZINC/NICKEL ACADEMY/NewRomanic Cyber Army Team/Whois Hacking Team/Appleworm/Group 77/G0032 (Reconnaissance General Bureau, Bureau 121, Unit 180, Lab 110);Lazarus Group/Labyrinth Chollima/HIDDEN COBRA/Guardians of Peace/Diamond Sleet fka ZINC/NICKEL ACADEMY/NewRomanic Cyber Army Team/Whois Hacking Team/Appleworm/Group 77/G0032 (Reconnaissance General Bureau, Bureau 121, Unit 180, Lab 110) |
| 02/01/2018 | Unnamed South Korean Company | KR | Andariel |
| 2018-05-23 | 해커그룹 안다리엘, 액티브X 취약점 악용 국내 지속 공격 | Lazarus; 라자루스; Andariel; 안다리엘 | |
| 2018-07-13 | 북한 배후 해커그룹 '안다리엘' 10년 추적기 | Andariel; 안다리엘 | |
| 2019-07 | MarkAny | Korea, Republic of | Andariel |
| 2022-07 | Maui Ransomware | United States, 🇯🇵 Japan | Andariel |
| 2022-03 | Arkansas Healthcare Company | United States | Andariel |
| 2024-04 | Defense Contractors | Korea, Republic of | |
| 2022-11 | Massachusetts Defense Company | United States | Andariel |
| 2022-04 | Michigan Defense Company | United States | Andariel |
| 2022-04 | Randolph Air Force Base | United States | Andariel |
| 2022-04 | Robins Air Force Base | United States | Andariel |
| 2022-04 | Oregon Defense Company | United States | Andariel |
| 2022-03 | Connecticut Healthcare Company | United States | Andariel |
| 2022-03 | Florida Hospital | United States | Andariel |
| 2022-03 | Colorado Medical Clinic | United States | Andariel |
| 2022-03 | California Defense Company | United States | Andariel |
| 2022-02 | NASA | United States | Andariel |
| 2022-01 | Chinese Energy Company | China | Andariel |
| 01.10.2022 | North Korean state-sponsored APT Andariel stole data from unnamed South Korean defence manufacturer through accessing maintenance/repair partner, starting in October 2022 | Korea, Republic of | Andariel/APT45/Onyx Sleet fka PLUTONIUM/Silent Chollima/Stonefly/G0138/DarkSeoul < Lazarus Group/Labyrinth Chollima/HIDDEN COBRA/Guardians of Peace/Diamond Sleet fka ZINC/NICKEL ACADEMY/NewRomanic Cyber Army Team/Whois Hacking Team/Appleworm/Group 77/G0032 (Reconnaissance General Bureau, Bureau 121, Unit 180, Lab 110) |
| 22.12.2022 | State-sponsored North Korean hacker group Andariel stole sensitive information from South Korean defense companies as well as research institutes and pharmaceutical companies since at least 22 December 2022 | Korea, Republic of;Not available;Not available | Andariel/APT45/Onyx Sleet fka PLUTONIUM/Silent Chollima/Stonefly/G0138/DarkSeoul < Lazarus Group/Labyrinth Chollima/HIDDEN COBRA/Guardians of Peace/Diamond Sleet fka ZINC/NICKEL ACADEMY/NewRomanic Cyber Army Team/Whois Hacking Team/Appleworm/Group 77/G0032 (Reconnaissance General Bureau, Bureau 121, Unit 180, Lab 110) |
| 01.11.2022 | North Korean state-sponsored APT groups 'Ruby Sleet' and 'Diamond Sleet' compromised two arms manufacturers in Germany and Israel beginning in November 2022 | Israel;Germany | Ruby Sleet fka CERIUM;Andariel/APT45/Onyx Sleet fka PLUTONIUM/Silent Chollima/Stonefly/G0138/DarkSeoul < Lazarus Group/Labyrinth Chollima/HIDDEN COBRA/Guardians of Peace/Diamond Sleet fka ZINC/NICKEL ACADEMY/NewRomanic Cyber Army Team/Whois Hacking Team/Appleworm/Group 77/G0032 (Reconnaissance General Bureau, Bureau 121, Unit 180, Lab 110) |
| 2022-12-16T00:00:00.000Z | Discover Activities Linked to the DPRK-nexus Intrusion Sets (2022 review: AppleJeus, SnatchCrypto, DreamJob) | Kimsuky; Lazarus; Bluenoroff; Andariel | |
| 2023-03 | South Korean Manufacturing Company | Korea, Republic of | Andariel |
| 2023-01 | Taiwanese Defense Company | Taiwan | Andariel |
| 2023-08-22 | Andariel 그룹의 새로운 공격 활동 분석 | Andariel; Kimsuky; Lazarus | |
| 01.10.2023 | North Korean state-sponsored hacking group Diamond Sleet compromised vulnerable TeamCity servers since early October 2023 | Not available | Andariel/APT45/Onyx Sleet fka PLUTONIUM/Silent Chollima/Stonefly/G0138/DarkSeoul < Lazarus Group/Labyrinth Chollima/HIDDEN COBRA/Guardians of Peace/Diamond Sleet fka ZINC/NICKEL ACADEMY/NewRomanic Cyber Army Team/Whois Hacking Team/Appleworm/Group 77/G0032 (Reconnaissance General Bureau, Bureau 121, Unit 180, Lab 110) |
| 01.01.2023 | North Korean state-sponsored APT group 'Diamond Sleet' compromised defence companies in several countries in January 2023 | Norway;Finland;Italy;Brazil;Poland;Czech Republic | Andariel/APT45/Onyx Sleet fka PLUTONIUM/Silent Chollima/Stonefly/G0138/DarkSeoul < Lazarus Group/Labyrinth Chollima/HIDDEN COBRA/Guardians of Peace/Diamond Sleet fka ZINC/NICKEL ACADEMY/NewRomanic Cyber Army Team/Whois Hacking Team/Appleworm/Group 77/G0032 (Reconnaissance General Bureau, Bureau 121, Unit 180, Lab 110) |
| 01.03.2023 | North Korean APT group 'Onyx Sleet' targeted Russian University in March 2023 | Russia;Russia | Andariel/APT45/Onyx Sleet fka PLUTONIUM/Silent Chollima/Stonefly/G0138/DarkSeoul < Lazarus Group/Labyrinth Chollima/HIDDEN COBRA/Guardians of Peace/Diamond Sleet fka ZINC/NICKEL ACADEMY/NewRomanic Cyber Army Team/Whois Hacking Team/Appleworm/Group 77/G0032 (Reconnaissance General Bureau, Bureau 121, Unit 180, Lab 110) |
| 2023-11-10 | 자산 관리 프로그램을 악용한 공격 정황 포착 (Andariel 그룹) | Andariel; Kimsuky; Lazarus | |
| 2023-02-15 | Distribution of Malware Exploiting Vulnerable Innorix: Andariel | Andariel | |
| 05/12/2023 | South Korean companies connected to the defense industry | KR | Andariel |
| 05/12/2023 | Three organizations in South Korea and abroad | KR N/A | Andariel |
| 2023-07-07 | Threat Trend Report on APT Groups – May 2023 | APT37; Andariel; Kimsuky; Lazarus; ScarCruft | |
| 2023-08-16 | Threat Trend Report on APT Groups – June 2023 | APT37; Andariel; Kimsuky; Lazarus | |
| 2023-10-04 | Lazarus 위협 그룹의 Volgmer, Scout 악성코드 분석 보고서 | Andariel; Lazarus | |
| 2023-10-23 | 2023 Aug – Threat Trend Report on APT Groups | APT37; Andariel; Kimsuky; Lazarus | |
| 2023-11-13 | 2023 Sep – Threat Trend Report on APT Groups | APT37; Andariel; KONNI; Kimsuky; Konni; Lazarus | |
| 2023-11-17 | Andariel 그룹의 Apache ActiveMQ 취약점 (CVE-2023-46604) 공격 정황 | Andariel; Kimsuky; Lazarus | |
| 2023-12-08 | 2023 Oct – Threat Trend Report on APT Groups | Andariel; Kimsuky; Lazarus | |
| 2023 | Andariel exfiltration of pharmaceutical research and development and weapons development data | Andariel | |
| 2023-10-10 (datePublished) | Andariel (UNC614) MAUI ransomware against hospitals | Andariel (UNC614) | |
| 2024-10 | Play Ransomware | Andariel | |
| 2024-06 | AnOctopus | Korea, Republic of | Andariel |
| 01.08.2024 | North Korean state-sponsored hacking group Stonefly launched an attack on US companies in August 2024 | United States | Andariel/APT45/Onyx Sleet fka PLUTONIUM/Silent Chollima/Stonefly/G0138/DarkSeoul < Lazarus Group/Labyrinth Chollima/HIDDEN COBRA/Guardians of Peace/Diamond Sleet fka ZINC/NICKEL ACADEMY/NewRomanic Cyber Army Team/Whois Hacking Team/Appleworm/Group 77/G0032 (Reconnaissance General Bureau, Bureau 121, Unit 180, Lab 110) |
| 01.04.2024 | North Korean APT Group Andariel targeted South Korean construction and machinery companies in April 2024 | Korea, Republic of;Korea, Republic of | Andariel/APT45/Onyx Sleet fka PLUTONIUM/Silent Chollima/Stonefly/G0138/DarkSeoul < Lazarus Group/Labyrinth Chollima/HIDDEN COBRA/Guardians of Peace/Diamond Sleet fka ZINC/NICKEL ACADEMY/NewRomanic Cyber Army Team/Whois Hacking Team/Appleworm/Group 77/G0032 (Reconnaissance General Bureau, Bureau 121, Unit 180, Lab 110) |
| July 25, 2024 | RGB 3rd Bureau (Andariel) global espionage against defense, aerospace, nuclear, engineering | Andariel, Onyx Sleet (formerly PLUTONIUM), DarkSeoul, Silent Chollima, and Stonefly/Clasiopa (RGB 3rd Bureau) | |
| 2024-05-16 | Dora RAT을 이용한 국내 기업 대상 APT 공격 사례 분석 (Andariel 그룹) | Andariel; Kimsuky; Lazarus | |
| 2024-06-24 | 국내 기업 대상 공격에 사용 중인 Xctdoor 악성코드 (Andariel) | Andariel; Kimsuky; Lazarus | |
| 2024-01-09 | 2023년 12월 APT 그룹 동향 보고 | Andariel; Lazarus | |
| 2024-03-11 | 국내 자산 관리 솔루션을 악용하여 공격 중인 Andariel 그룹 (MeshAgent) | Andariel; Kimsuky; Lazarus | |
| 2024-04-05 | 2024년 3월 APT 그룹 동향 보고서 | Andariel; Kimsuky | |
| 2024-05-27 | 국내 기업 대상 공격에 사용 중인 SmallTiger 악성코드 (Kimsuky, Andariel 그룹) | Andariel; Kimsuky | |
| 2024-06-05 | 2024년 5월 APT 그룹 동향 보고서 | Andariel; Kimsuky | |
| 2024-08-12 | 2024년 7월 APT 그룹 동향 보고서 | APT45; Andariel | |
| 2024-11-12 | 2024년 10월 APT 그룹 동향 보고서 | Andariel | |
| 2024-12-23 | Andariel 그룹의 국내 솔루션 대상 공격 사례 분석 (SmallTiger) | Andariel | |
| January 2024 - September 2025 (reporting period) | Andariel compromises of U.S., ROK, UAE and Israeli IT and defense-related companies | United States; Republic of Korea; UAE; Israel | Andariel |
| May 2024 | Supply chain attack via a DLP software update server against ROK aerospace and shipbuilding defense companies | Republic of Korea | Andariel |
| Q2 2024 (from title: APT Quarterly Highlights : Q2 2024) | Moonstone Sleet, Lazarus Kaolin RAT and Kimsuky Gomir/ReconShark activity | South Korea | Kimsuky (Springtail); Moonstone Sleet (Storm-1789); Lazarus Group; Andariel |
| 2025-02 | Somansa | Korea, Republic of | Andariel |
| 2025-01-23 | Andariel 공격 그룹이 활용하는 RID Hijacking 공격 기법 | Andariel | |
| 2025-02-12 | 2025년 1월 APT 그룹 동향 보고서 | Andariel | |
| 2025-11-30 | 라자루스부터 안다리엘까지…북한 3대 해킹조직 어떻게 침투했나 | Lazarus; 라자루스; Kimsuky; 김수키; Andariel; 안다리엘 | |
| 2026-03 | Rook Ransomware | Korea, Republic of | Andariel |
| 2026-01-08 | 2025년 4분기 윈도우 웹 서버 대상 악성코드 통계 보고서 | Andariel | |
| 2026-02-13 | 2026년 1월 APT 그룹 동향 보고서 | APT43; Andariel; KONNI; Kimsuky; Konni; Lazarus | |
| 2026-05-21 | 2026년 4월 국내외 금융권 관련 보안 이슈 | APT38; Andariel; BlueNoroff | |
| 2026-08-06 | Xctdoor와 과거 CRAT 공격 사례의 연관성 분석 (Larva-26005) | Andariel; Larva-26005; Lazarus | |
| 2026-09-16 | Ransomware Landscape in H1 2026: Statistics and Key Issues | Andariel; Lazarus; puNK-012 | |
| (not dated) | Andariel ransomware attacks against US healthcare organisations | United States | Andariel |
| Andariel Tdrop malware attacks (C2 servers registered via Yahoo accounts) | Andariel | ||
| September/ October | https://www.microsoft.com/en-us/security/blog/2023/10/18/multiple-north-korean-threat-actors-exploiting-the-teamcity-cve-2023-42793-vulnerability/ https://www.microsoft.com/en-us/security/blog/2023/11/22/diamond-sleet-supply-chain-compromise-distributes-a-modified-cyberlink-installer/ | Lazarus/ Andariel | |
| October | security-insider/microsoft-digital-defense-report-2023?rtc=1 | Lazarus/ Andariel/ BlueNoroff | |
| November | https://asec.ahnlab.com/en/59073/ | Andariel | |
| November | https://asec.ahnlab.com/ko/59130/ https://asec.ahnlab.com/en/59318/ | Andariel | |
| December | https://www.koreatimes.co.kr/www/nation/2023/12/103_364423.html | Andariel | |
| Andariel ransomware attacks on three companies | Andariel |