Five threat groups that target Korea,
from public sources
Everything here comes from MITRE ATT&CK group pages, government advisories and security vendor reports.
For each group we list the techniques it tends to use, what to look for in your own logs, and how to check whether those techniques are actually blocked.
At a glance
MITRE ATT&CK associates all five groups with the North Korean government.
Genox has made no attribution judgments of its own, and the incidents mentioned are only those described in public sources.
| Group | ATT&CK ID | Main objective | Targets named in public sources (Korea-related) | Key public source |
|---|---|---|---|---|
| Lazarus Group | G0032 | Espionage, financial theft, destruction | Finance, cryptocurrency, defense and aerospace. MITRE also notes links to operations such as DarkSeoul and Ten Days of Rain | CISA AA22-108A |
| Kimsuky | G0094 | Espionage | Government agencies, think tanks, experts in diplomacy, security and North Korea, media | CISA AA20-301A, joint ROK-US advisory (June 2023) |
| APT37 | G0067 | Espionage | Mainly South Korea. Watering hole attacks through Korean websites | FireEye (2018), Volexity (2021) |
| Andariel | G0138 | Espionage, financial theft | Government agencies, military, Korean companies, defense, aerospace, nuclear and engineering | CISA AA24-207A (co-authored with Korea's NIS and National Police Agency) |
| APT38 | G0082 | Financial theft | Banks, cryptocurrency exchanges, payment systems. There is no evidence it targets Korea specifically, but Korean financial institutions fall in the same target group | CISA AA20-239A |
As of 2026-11-07. We rechecked the MITRE ATT&CK group pages on this date. Technique lists and aliases change with each ATT&CK version, so check the original pages again before you rely on them.
Lazarus Group
MITRE describes it as a group tied to the Reconnaissance General Bureau (RGB) and active since at least 2009. It also notes that because North Korean groups share people and tools, "Lazarus" is often used as an umbrella name for North Korean activity in general. Each report draws the boundary differently, so don't assume two reports describe the same actor just because they use the same name.
Aliases
Main targets
Financial institutions, cryptocurrency users, and employees in defense and aerospace. In Operation Dream Job (2019 to 2020), the group approached defense and aerospace staff with fake job offers and LinkedIn accounts.
Initial access
Recruitment-themed spearphishing is the best-known method. CISA AA22-108A describes how the group offered well-paid jobs to system administrators and DevOps staff at blockchain companies, then got them to download malicious apps disguised as cryptocurrency trading apps (TraderTraitor). An update function inside the app downloads and runs more malware.
A joint advisory from the UK NCSC and Korea's National Intelligence Service (NIS) in November 2023 covers a supply chain attack that went through a news media site to exploit a flaw in MagicLine4NX (CVE-2023-45797), a Korean security authentication product. The advisory refers only to DPRK-linked actors and does not name a specific group.
| Technique ID | Technique | Tactic |
|---|---|---|
| T1566.001 | Spearphishing Attachment | Initial Access |
| T1566.002 | Spearphishing Link | Initial Access |
| T1059.001 | PowerShell | Execution |
| T1543.003 | Windows Service | Persistence |
| T1547.001 | Registry Run Keys / Startup Folder | Persistence |
| T1110.003 | Password Spraying | Credential Access |
| T1557.001 | LLMNR/NBT-NS Poisoning and SMB Relay | Credential Access |
| T1560.001 | Archive via Utility | Collection |
| T1041 | Exfiltration Over C2 Channel | Exfiltration |
| T1485 | Data Destruction | Impact |
What to check in detection
- Whether PowerShell or cmd starts right after an archive or installer received by messenger or email is run. Look at the parent and child relationship in the EDR process tree or Sysmon Event ID 1 (process creation).
- New service installs (System log 7045) and Run key changes (Sysmon 13). For services created outside business hours, check the binary path and signature even if the name looks legitimate.
- Repeated login failures across many accounts from one source. You need Windows Security logs 4625 and 4771 together with your cloud identity provider's sign-in logs to see spraying.
- Hosts on the network answering LLMNR (UDP 5355) or NBT-NS (UDP 137). If you don't use them, turning them off through Group Policy is more reliable than detection.
- Korean business security software, such as certificate and digital signature agents, spawning a shell or connecting to an unfamiliar external address. Supply chain attacks come in through legitimate programs like these.
Kimsuky
An espionage group active since at least 2012. It first went after South Korean government agencies, think tanks and subject matter experts, then expanded to the UN and to government, education and manufacturing organizations in the US, Japan, Russia and Europe. MITRE cites sources that attribute the 2014 compromise of Korea Hydro & Nuclear Power to this group.
Aliases
Main targets
People and organizations working on Korean Peninsula diplomacy and security, nuclear policy and North Korea sanctions. The joint ROK-US advisory of June 2023 documents cases where the group impersonated journalists, researchers and government officials to reach think tanks, academia and media.
Initial access
A pattern that keeps showing up in public cases is a first email with no malicious file at all, just an interview or advisory request. Once the target replies, the next email carries an HWP or Office document, a zipped LNK file, or a cloud storage link. Credential phishing links that mimic login security alerts are also common. A 2024 advisory from the FBI and others covers emails sent by spoofing domains with weak DMARC policies.
| Technique ID | Technique | Tactic |
|---|---|---|
| T1566.001 | Spearphishing Attachment (HWP, Office, zipped LNK) | Initial Access |
| T1566.002 | Spearphishing Link | Initial Access |
| T1204.002 | Malicious File | Execution |
| T1059.001 | PowerShell | Execution |
| T1218.005 | Mshta | Defense Evasion |
| T1547.001 | Registry Run Keys / Startup Folder | Persistence |
| T1053.005 | Scheduled Task | Persistence |
| T1003.001 | LSASS Memory | Credential Access |
| T1555.003 | Credentials from Web Browsers | Credential Access |
| T1102.002 | Bidirectional Communication | Command and Control |
What to check in detection
- mshta.exe connecting to an external URL, or running under explorer.exe by way of an LNK file. Regular user PCs rarely need mshta, so a baseline alone filters most of this out.
- Whether the Hangul word processor (Hwp.exe) or an Office process spawns cmd, PowerShell or wscript as a child.
- Scheduled tasks created with user privileges. Check the task name and the command it runs together, in Security log 4698 or the Microsoft-Windows-TaskScheduler operational log.
- Non-browser processes reading the Login Data or Cookies files of Chrome or Edge, and newly installed browser extensions.
- On the mail gateway, mail from external senders whose display name is an official or a journalist. Also check that your own domain's DMARC policy is not still at p=none.
- A new local administrator account (4720, 4732) combined with Remote Desktop being enabled. A change to the fDenyTSConnections registry value also catches this.
APT37
An espionage group active since at least 2012. MITRE lists South Korea as its primary target, and activity has also been reported in Japan, Vietnam, Russia and the Middle East. Many reports describe the same approach of compromising Korean websites to go after their visitors.
Aliases
Main targets
Per MITRE's description, the primary target country is South Korea. In the Volexity case below, readers of a news site focused on North Korea were targeted. Operations from 2016 to 2018 such as Operation Daybreak, Erebus, Golden Time and FreeMilk are linked to this group.
Initial access
Watering holes, distribution through torrent sites, spearphishing with HWP attachments, and exploits against browsers and document software. Volexity reported that in 2021 exploit code for Internet Explorer vulnerabilities (CVE-2020-1380, CVE-2021-26411) was planted on the site of Daily NK, a news outlet covering North Korea, and that BLUELIGHT malware communicating over the Microsoft Graph API was used afterward.
| Technique ID | Technique | Tactic |
|---|---|---|
| T1189 | Drive-by Compromise (watering hole) | Initial Access |
| T1566.001 | Spearphishing Attachment | Initial Access |
| T1203 | Exploitation for Client Execution | Execution |
| T1059.005 | Visual Basic | Execution |
| T1547.001 | Registry Run Keys / Startup Folder | Persistence |
| T1548.002 | Bypass User Account Control | Privilege Escalation |
| T1055 | Process Injection | Defense Evasion |
| T1027.003 | Steganography | Defense Evasion |
| T1123 | Audio Capture | Collection |
| T1102.002 | Bidirectional Communication (cloud and social media services) | Command and Control |
What to check in detection
- A browser process spawning an executable or a script engine as a child. This almost never happens in normal use, so the rule produces few false positives.
- Remaining use of Internet Explorer mode and mshtml. Pulling the list of PCs using IE mode from your asset data makes patch prioritization easier.
- Whether non-browser processes connect to cloud APIs such as Dropbox, pCloud, Box, Yandex or the Microsoft Graph API. This is only meaningful when proxy or DNS logs are tied to the process name.
- A process that creates executable memory right after downloading an image file (a payload hidden with steganography).
- Network connections made after an HWP document is opened, and new executables in temp folders.
Andariel
MITRE treats Andariel as a sub-group of Lazarus Group and says it has mainly targeted South Korean government agencies, the military and Korean companies since at least 2009. Alongside destructive attacks, it has also carried out financially motivated activity against ATMs, banks and cryptocurrency exchanges. CISA AA24-207A (July 2024) was published jointly by US and UK agencies together with Korea's National Intelligence Service and the Korean National Police Agency.
Aliases
Main targets
According to AA24-207A, defense, aerospace, nuclear and engineering are the primary targets, followed by healthcare and energy. The same advisory says ransomware proceeds from attacks on US healthcare organizations were used to fund espionage activity.
Initial access
Mostly exploiting known vulnerabilities in internet-facing servers and dropping web shells. The advisory names Log4j (CVE-2021-44228), Apache ActiveMQ (CVE-2023-46604) and TeamCity (CVE-2023-42793), among others. It also mentions phishing with LNK or HTA files inside ZIP archives.
| Technique ID | Technique | Tactic |
|---|---|---|
| T1592.002 | Gather Victim Host Information: Software | Reconnaissance |
| T1190 | Exploit Public-Facing Application (AA24-207A) | Initial Access |
| T1189 | Drive-by Compromise | Initial Access |
| T1566.001 | Spearphishing Attachment | Initial Access |
| T1203 | Exploitation for Client Execution | Execution |
| T1505.003 | Web Shell (AA24-207A) | Persistence |
| T1027.003 | Steganography | Defense Evasion |
| T1049 | System Network Connections Discovery | Discovery |
| T1057 | Process Discovery | Discovery |
| T1105 | Ingress Tool Transfer | Command and Control |
Unmarked techniques come from the MITRE group page. Those marked in parentheses come from the CISA advisory.
What to check in detection
- Whether Java server processes such as Tomcat, ActiveMQ or TeamCity launch cmd, PowerShell or sh. The moment a web server account runs a shell is often the earliest signal you get.
- New or modified jsp, aspx or php files in the web root. If you have no file integrity monitoring, start by comparing deployment history with file modification times.
- Command patterns named in the advisory: netstat to list connections, curl to fetch files into a temp folder, and vssadmin to create a volume shadow copy followed by copying NTDS.dit.
- Dual-use tools such as Mimikatz, ProcDump, AdFind, Impacket and PLINK. Compare against the tools your administrators actually use to cut down false positives.
- Executables packed with VMProtect or Themida, RDP movement between internal servers, and large transfers out to cloud storage or FTP after that.
APT38
A financially motivated group tied to the Reconnaissance General Bureau. Since at least 2014 it has targeted banks, financial institutions, casinos, cryptocurrency exchanges, SWIFT terminals and ATMs in at least 38 countries. The 2016 Bangladesh Bank incident is the case most often cited. Public sources don't single out Korea, but we included the group because Korean financial companies and virtual asset service providers fall in the same target group.
Aliases
Main targets
Bank payment switch servers and SWIFT terminals, interbank payment processors, and cryptocurrency exchanges. The MITRE group page also lists a software supply chain compromise that used npm packages.
Initial access
CISA AA20-239A lists spearphishing with attachments disguised as job applications, watering holes, vulnerabilities in internet-facing applications, stolen legitimate accounts, third parties with business relationships, and external remote access services. After gaining access, the group used FASTCash malware, which intercepts ISO 8583 authorization messages on the payment switch to approve ATM cash withdrawals.
| Technique ID | Technique | Tactic |
|---|---|---|
| T1195.001 | Compromise Software Dependencies and Development Tools | Initial Access |
| T1566.001 | Spearphishing Attachment | Initial Access |
| T1189 | Drive-by Compromise | Initial Access |
| T1059.001 | PowerShell | Execution |
| T1543.003 | Windows Service | Persistence |
| T1553.005 | Mark-of-the-Web Bypass | Defense Evasion |
| T1070.006 | Timestomp | Defense Evasion |
| T1565.002 | Transmitted Data Manipulation | Impact |
| T1657 | Financial Theft | Impact |
| T1485 | Data Destruction | Impact |
What to check in detection
- New processes and shared libraries on payment switch servers (including AIX and Linux). These servers rarely change, so allowlisting works well.
- Logins to SWIFT terminals and payment servers outside business hours, and admin sessions from unusual sources.
- New firewall exceptions for ports 443, 6443, 8443 or 9443. This pattern appears in AA20-239A, so you can check it directly against change management records.
- postinstall scripts that connect out or spawn a shell during npm install on developer PCs and build servers.
- Files run from inside disk images such as ISO, IMG or VHD (MotW bypass), and event log clearing (Security log 1102).
Caveats
Group profiles are a good starting point, but if you turn them straight into detection rules you will miss things.
Group names and boundaries differ by vendor
Even MITRE adds a note to all five group pages to the effect that definitions of North Korean groups overlap heavily. Andariel is sometimes grouped as a sub-group of Lazarus, and APT38 is sometimes treated as the same as BlueNoroff. Preparing by technique is less confusing than preparing by group name.
We left out IoCs on purpose
Hashes, IPs and domains change within weeks. If you need them, download the STIX files and YARA rules attached to the advisories above. This page focuses on behavior patterns that stay valid longer.
The technique lists are a selection
Each group has dozens of techniques registered in ATT&CK. We picked 6 to 10 per group so the flow from initial access to impact is visible. You can download the full list as an ATT&CK Navigator layer from the MITRE group page.
Detection items mean nothing without the logs
When we run assessments, we often find Sysmon installed on only some servers, or PowerShell script block logging (4104) turned off. Before working through the items above, confirm those logs are actually being collected.
Want to know whether these techniques are blocked in your environment?
In a proactive validation, we run these groups' techniques within the scope you approve and map what was blocked, detected or missed on ATT&CK. For threat intelligence subscriptions, see the threat intelligence page.
References
All accessed and checked on 2026-11-07.
- Lazarus Group, G0032, MITRE ATT&CK
- Kimsuky, G0094, MITRE ATT&CK
- APT37, G0067, MITRE ATT&CK
- Andariel, G0138, MITRE ATT&CK
- APT38, G0082, MITRE ATT&CK
- TraderTraitor: North Korean State-Sponsored APT Targets Blockchain Companies (AA22-108A), FBI · CISA · US Treasury, April 2022
- UK and Republic of Korea issue warning about DPRK state-linked cyber actors attacking software supply chains, UK NCSC · Korea NIS, November 2023
- North Korean Advanced Persistent Threat Focus: Kimsuky (AA20-301A), CISA · FBI · CNMF, October 2020
- North Korea Using Social Engineering to Enable Hacking of Think Tanks, Academia, and Media, Korea NIS · Korean National Police Agency · ROK Ministry of Foreign Affairs · FBI · US Department of State · NSA, June 2023
- North Korean Actors Exploit Weak DMARC Security Policies to Mask Spearphishing Efforts, FBI and others, May 2024
- APT37 (Reaper): The Overlooked North Korean Actor, FireEye, 2018
- North Korean APT InkySquid Infects Victims Using Browser Exploits, Volexity, August 2021
- North Korea Cyber Group Conducts Global Espionage Campaign to Advance Regime's Military and Nuclear Programs (AA24-207A), FBI · CISA · NSA · Korea NIS · Korean National Police Agency and others, July 2024
- FASTCash 2.0: North Korea's BeagleBoyz Robbing Banks (AA20-239A), CISA · US Treasury · FBI · USCYBERCOM, August 2020
- APT38: Un-usual Suspects, FireEye, 2018