Kaspersky Securelist
IT threat evolution Q2 2021 (DPRK-related paragraph 3) · 2021-08-12
We also found additional connections with the Andariel group. Each threat actor has a characteristic habit when they interactively work with a backdoor shell in the post-exploitation phase of an attack. The way Windows commands and their options were used in this campaign is almost identical to previous Andariel activity.