APT38

{
  "id": "ATTACK:ics:G0082",
  "title": "APT38",
  "type": "IntrusionSet",
  "source_url": "https://attack.mitre.org/groups/G0082",
  "snapshot": "ics-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "intrusion-set--00f67a77-86a4-4adf-be26-1a54fc713340",
  "external_id": "G0082",
  "domain": "ics",
  "created": "2019-01-29T21:27:24.793Z",
  "modified": "2026-10-09T03:56:03.463Z",
  "version": "4.0",
  "aliases": [
    "APT38",
    "NICKEL GLADSTONE",
    "BeagleBoyz",
    "Bluenoroff",
    "Stardust Chollima",
    "Sapphire Sleet",
    "COPERNICIUM"
  ],
  "tactics": [

  ],
  "source_references": [
    {
      "source_name": "BeagleBoyz"
    },
    {
      "source_name": "Stardust Chollima"
    },
    {
      "source_name": "APT38"
    },
    {
      "source_name": "Bluenoroff"
    },
    {
      "source_name": "Sapphire Sleet"
    },
    {
      "source_name": "COPERNICIUM"
    },
    {
      "source_name": "NICKEL GLADSTONE"
    },
    {
      "source_name": "CrowdStrike GTR 2021 June 2021",
      "url": "https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2021GTR.pdf"
    },
    {
      "source_name": "DOJ North Korea Indictment Feb 2021",
      "url": "https://www.justice.gov/opa/pr/three-north-korean-military-hackers-indicted-wide-ranging-scheme-commit-cyberattacks-and"
    },
    {
      "source_name": "CISA AA20-239A BeagleBoyz August 2020",
      "url": "https://us-cert.cisa.gov/ncas/alerts/aa20-239a"
    },
    {
      "source_name": "FireEye APT38 Oct 2018",
      "url": "https://services.google.com/fh/files/misc/apt38-un-usual-suspects.pdf"
    },
    {
      "source_name": "Kaspersky Lazarus Under The Hood Blog 2017",
      "url": "https://securelist.com/lazarus-under-the-hood/77908/"
    },
    {
      "source_name": "CrowdStrike Stardust Chollima Profile April 2018",
      "url": "https://www.crowdstrike.com/blog/meet-crowdstrikes-adversary-of-the-month-for-april-stardust-chollima/"
    },
    {
      "source_name": "Microsoft Threat Actor Naming July 2023",
      "url": "https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide"
    },
    {
      "source_name": "Microsoft Axios Compromise APR 2026",
      "url": "https://www.microsoft.com/en-us/security/blog/2026/04/01/mitigating-the-axios-npm-supply-chain-compromise/"
    },
    {
      "source_name": "Microsoft Sapphire Sleet APR 2026",
      "url": "https://www.microsoft.com/en-us/security/blog/2026/04/16/dissecting-sapphire-sleets-macos-intrusion-from-lure-to-compromise/"
    },
    {
      "source_name": "MIcrosoft Mastra npm Compromise JUN 2026",
      "url": "https://www.microsoft.com/en-us/security/blog/2026/06/17/postinstall-payload-inside-mastra-npm-supply-chain-compromise/"
    },
    {
      "source_name": "SecureWorks NICKEL GLADSTONE profile Sept 2021",
      "url": "https://www.secureworks.com/research/threat-profiles/nickel-gladstone"
    }
  ]
}