Mandiant / Google Cloud Threat Intelligence blog
APT45 long-running espionage, financial and possible ransomware operations (since 2009) · 2024-07-25 (datePublished)
Although the group's earliest observed activities consisted of espionage campaigns against government agencies and defense industries, APT45 has expanded its remit to financially-motivated operations, including targeting of the financial vertical; we also assess with moderate confidence that APT45 has engaged in the development of ransomware. ... Among the groups assessed to operate from the Democratic People's Republic of Korea (DPRK), APT45 has been the most frequently observed targeting critical infrastructure.