Threat Group Cards: A Threat Actor Encyclopedia

APT group: Subgroup: Andariel, Silent Chollima

Names	Andariel (FSI) Silent Chollima (CrowdStrike) Stonefly (Symantec) Plutonium (Microsoft)
Country	North Korea
Motivation	Information theft and espionage
First seen	2014
Description	A subgroup of Lazarus Group, Hidden Cobra, Labyrinth Chollima.
Observed
Tools used
Operations performed	2014	Operation “BLACKMINE” Target: South Korean organizations. Method: Information theft and espionage.
	2014	Operation “GHOSTRAT” Target: Defense industry. Method: Information theft and espionage.
	2014	Operation “XEDA” Target: Foreign defense industries. Method: Information theft and espionage.
	2015	Operation “INITROY”/Phase 1 Target: South Korean organizations. Method: Information theft/early phase operation.
	2015	Operation “DESERTWOLF”/Phase 3 Target: South Korean defense industry. Method: Information theft and espionage.
	2015	Operation “BLACKSHEEP”/Phase 3. Target: Defense industry. Method: Information theft and espionage.
	2016	Operation “INITROY”/Phase 2 Target: South Korean organizations. Method: Information theft/early phase operation.
	2016	Operation “VANXATM” Target: ATM companies. Method: Financial theft/BPC.
	2017	Operation “Mayday” Target: South Koran Financial Company. Method: Information theft and espionage.
	Jun 2018	Operation “GoldenAxe” <https://blog.trendmicro.com/trendlabs-security-intelligence/new-andariel-reconnaissance-tactics-hint-at-next-targets/>
	Apr 2021	Lazarus APT conceals malicious code within BMP image to drop its RAT <https://blog.malwarebytes.com/malwarebytes-news/2021/04/lazarus-apt-conceals-malicious-code-within-bmp-file-to-drop-its-rat/> <https://securelist.com/andariel-evolves-to-target-south-korea-with-ransomware/102811/>
	Jun 2021	Andariel evolves to target South Korea with ransomware <https://securelist.com/andariel-evolves-to-target-south-korea-with-ransomware/102811/>
	Feb 2022	Stonefly: North Korea-linked Spying Operation Continues to Hit High-value Targets <https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/stonefly-north-korea-espionage>
	Aug 2022	Andariel deploys DTrack and Maui ransomware <https://securelist.com/andariel-deploys-dtrack-and-maui-ransomware/107063/>
MITRE ATT&CK	<https://attack.mitre.org/groups/G0138/>

Last change to this card: 30 December 2022

Download this actor card in PDF or JSON format

Previous: Lazarus Group, Hidden Cobra, Labyrinth Chollima
Next: Subgroup: BeagleBoyz