APT38

Origin🇰🇵 Coreia do Norte

Techniques (MITRE ATT&CK)56

SourceMITRE ATT&CK

State sponsor: Korea (Democratic People's Republic of)Attribution confidence: 50%Target categories: Government, Private sector

Targeted regions: South Korea · Bangladesh Bank · Sony Pictures Entertainment · United States · Thailand · France · China · Hong Kong · United Kingdom · Guatemala +9

Also known as:APT-C-26ATK117ATK3AndarielApplewormBeagleBoyzBlack ArtemisBluenoroffBureau 121COPERNICIUMCOVELLITECitrine SleetDEV-0139DEV-1222Dark SeoulDiamond SleetG0032G0082Group 77Hastati GroupHidden CobraLabyrinth ChollimaLazarus groupMoonstone SleetNICKEL GLADSTONENewRomanic Cyber Army TeamNickel AcademyOperation AppleJeusOperation DarkSeoulOperation GhostSecretOperation TroySapphire SleetStardust ChollimaSubgroup: BluenoroffTA404Unit 121Whois Hacking TeamZINCZinc

About the group

APT38 is a North Korean state-sponsored threat group that specializes in financial cyber operations; it has been attributed to the Reconnaissance General Bureau. Active since at least 2014, APT38 has targeted banks, financial institutions, casinos, cryptocurrency exchanges, SWIFT system endpoints, and ATMs in at least 38 countries worldwide. Significant operations include the 2016 Bank of Bangladesh heist, during which APT38 stole $81 million, as well as attacks against Bancomext and Banco de Chile ; some of their attacks have been destructive. North Korean group definitions are known to have significant overlap, and some security researchers report all North Korean state-sponsored cyber activity under the name Lazarus Group instead of tracking clusters or subgroups.

Attack chain

Plausible scenario built from the group's real techniques, ordered by the phases of an attack. Each step shows how the group typically operates.

Arsenal severity68

Impact: High

Illustrative chain derived from techniques documented in MITRE ATT&CK — it does not represent a specific past attack. Severity summarizes the known arsenal (kill-chain coverage, actively exploited CVEs, techniques).

Techniques (MITRE ATT&CK) 56

How the group operates, mapped to the MITRE ATT&CK matrix and organized by the phases of an attack.

Resource development

Domains Tool

Initial access

Drive-by Compromise Spearphishing Attachment

Execution

Cron Scheduled Task PowerShell Windows Command Shell Visual Basic Native API Malicious Link Malicious File Service Execution

Persistence

Web Shell Windows Service

Privilege escalation

Bypass User Account Control

Credential access

Brute Force

Discovery

System Owner/User Discovery System Network Connections Discovery Process Discovery System Information Discovery File and Directory Discovery Network Share Discovery Browser Information Discovery Security Software Discovery

Collection

Data from Local System Keylogging Clipboard Data

Command and control

Web Protocols Ingress Tool Transfer

Impact

Data Destruction Data Encrypted for Impact System Shutdown/Reboot Disk Structure Wipe Stored Data Manipulation Transmitted Data Manipulation Runtime Data Manipulation

defense-impairment

Modify Registry Mark-of-the-Web Bypass Disable or Modify Tools Clear Windows Event Logs Disable or Modify System Firewall Network Device Firewall Prevent Command History Logging

stealth

Software Packing Rename Legitimate Utilities Space after Filename Process Injection File Deletion Timestomp Deobfuscate/Decode Files or Information Compiled HTML File Mshta Msiexec Rundll32 Mutual Exclusion

Exploited vulnerabilities 2

CVEs this group is known to exploit, per MITRE ATT&CK. Ordered by real-world severity.

CVE-2024-55591CRITICALEPSS 94%KEV MITRE ATT&CK

CVE-2017-8625EPSS 15% MITRE ATT&CK

Known infrastructure 28

Real indicators (C2, domains, URLs and hashes) associated with the malware this group uses. Source: abuse.ch (ThreatFox, URLhaus, MalwareBazaar).

ip:port188.132.242.67:8731DarkCometthreatfox

ip:port87.243.97.168:100DarkCometthreatfox

ip:port188.132.242.67:8087DarkCometthreatfox

urlhttp://92.127.156.174:8880/master.exeMimiKatzthreatfox

ip:port69.40.43.85:1604DarkCometthreatfox

ip:port74.162.154.113:1604DarkCometthreatfox

ip:port87.243.97.168:1604DarkCometthreatfox

md5_hashfec27228340485485f6902f8759bbd62MimiKatzthreatfox

sha256_hashf9d53fdcc12d548e6c9bd395642f30d2b2c6a9a4204bc0948badf8a7c571c072MimiKatzthreatfox

sha1_hash07b35a3b431e653ddcf36cecd49793d538e2aa79MimiKatzthreatfox

ip:port92.137.236.176:4444DarkCometthreatfox

ip:port88.231.147.247:1660DarkCometthreatfox

ip:port132.243.172.182:1604DarkCometthreatfox

ip:port189.150.86.165:1604DarkCometthreatfox

ip:port82.153.241.181:1604DarkCometthreatfox

ip:port189.150.106.61:2320DarkCometthreatfox

ip:port170.244.195.143:3000DarkCometthreatfox

ip:port79.100.86.116:1604DarkCometthreatfox

ip:port207.189.23.198:1024DarkCometthreatfox

ip:port176.129.203.146:1604DarkCometthreatfox

ip:port105.100.163.183:1604DarkCometthreatfox

ip:port151.247.193.128:7777DarkCometthreatfox

ip:port189.150.133.139:1604DarkCometthreatfox

ip:port86.109.75.132:7777DarkCometthreatfox

ip:port86.109.75.132:1604DarkCometthreatfox

md5_hash77c96f339974b65ae435313a8fcc3b35MimiKatzthreatfox

sha1_hashc5ec7e2ad924e832e49fbac9d0c82719b570e080MimiKatzthreatfox

sha256_hash889cc3e793cb39889c7acc8e73a84973e9a08fcd69451f7b546509c74ffdda90MimiKatzthreatfox

References

APT38 uses real techniques and exploits real flaws. TrueHacking's AI Autonomous Pentest simulates these attacks against your infrastructure and brings more security to your application.

Explore the AI Autonomous Pentest →