Dark River - DPRK Threat Actor | lazarus.day

Dark River

2023-09-27 • Ptsecurity • Dark River. You can't see them, but they're there

40

Related Actors
1

Related Reports

Related Actors

Jade Sleet

Microsoft

Trader Traitor

First seen: Jul 2023

Last seen: Oct 2024

Trader Traitor

USCISA

Bluenoroff

First seen: Apr 2022

Last seen: May 2026

UNC4899

Mandiant

Trader Traitor

First seen: Jul 2023

Last seen: Mar 2026

T-APT-15

Tencent

Bluenoroff

First seen: Mar 2018

Last seen: Mar 2018

APT38

Mandiant

Bluenoroff

First seen: Oct 2018

Last seen: Nov 2025

Beagle Boyz

USCISA

Bluenoroff

First seen: Aug 2020

Last seen: Mar 2021

Black Alicanto

PWC

Crypto Core

First seen: Sep 2021

Last seen: Apr 2023

Black Dev2

PWC

Bluenoroff

First seen: Sep 2021

Last seen: Apr 2023

Bluenoroff

Kaspersky

First seen: Apr 2017

Last seen: May 2026

Copernicium

Microsoft

APT38

First seen: Nov 2022

Last seen: Nov 2022

UNC785

Mandiant

TEMP.Hermit

First seen: Mar 2023

Last seen: Mar 2023

Crypto Core

Clearskysec

Bluenoroff

First seen: Jun 2020

Last seen: Oct 2025

Crypto Mimic

NTTSecurity

Crypto Core

First seen: Sep 2020

Last seen: Feb 2021

UNC786

Mandiant

TEMP.Hermit

First seen: Mar 2023

Last seen: Mar 2023

G0082

MITRE

APT38

First seen: Jan 2019

Last seen: Jan 2019

PUKCHONG

Google

UNC4899

First seen: Jun 2024

Last seen: Nov 2025

Leery Turtle

Cyberstruggle

Crypto Core

First seen: May 2020

Last seen: May 2020

Nickel Gladstone

Secure Works

Bluenoroff

First seen: Jun 2021

Last seen: Jun 2021

Slow Pisces

Paloalto Networks

Jade Sleet

First seen: Jun 2024

Last seen: Apr 2025

Alluring Pisces

Paloalto Networks

Bluenoroff

First seen: Sep 2024

Last seen: Feb 2025

TA444

Proofpoint

Crypto Core

First seen: Jan 2023

Last seen: Apr 2026

TEMP.Hermit

Fireeye

Bluenoroff

First seen: Mar 2023

Last seen: May 2025

Red Carpet

KRCERT

Bluenoroff

Sector A06

NSHC

Bluenoroff

First seen: Mar 2020

Last seen: Feb 2025

Stardust Chollima

Crowd Strike

Bluenoroff

First seen: Feb 2018

Last seen: Jun 2026

UNC4034

Mandiant

TEMP.Hermit

First seen: Sep 2022

Last seen: Nov 2022

UNC577

Mandiant

TEMP.Hermit

First seen: Mar 2023

Last seen: Mar 2023

UNC2970

Mandiant

TEMP.Hermit

First seen: Mar 2023

Last seen: Feb 2026

MASAN

Google

UNC1069

First seen: Nov 2025

Last seen: Nov 2025

CTG-6459

Secure Works

Nickel Gladstone

First seen: Jun 2021

Last seen: Jun 2021

Pressure Chollima

Crowd Strike

Jade Sleet

First seen: Jan 2026

Last seen: May 2026

Putrid Slug

Cloudflare

Bluenoroff

First seen: Mar 2026

Last seen: Mar 2026

Sapphire Sleet

Microsoft

Copernicium

First seen: Apr 2023

Last seen: Jun 2026

JINX-0164

Wiz

Sapphire Sleet

First seen: May 2026

Last seen: May 2026

Storm-0954

Microsoft

Jade Sleet

First seen: Apr 2023

Last seen: Apr 2023

TAG-71

Recorded Future

Bluenoroff

First seen: Jun 2023

Last seen: Jan 2024

UNC1069

Mandiant

Crypto Core

First seen: Apr 2023

Last seen: May 2026

UNC1758

Mandiant

TEMP.Hermit

First seen: Mar 2023

Last seen: Apr 2023

ATK117

Thales Group

APT38

First seen: Oct 2019

Last seen: May 2022

REF9135

Elastic

Bluenoroff

First seen: Jun 2023

Last seen: Jun 2023

Related Reports

Top Authors

View all reports in this cluster

2023-09-27

Ptsecurity

Dark River. You can't see them, but they're there

#MataDoor #DarkRiver #CVE-2021-40444 #T1090.001 #T1016 #T1106 #T1018 #T1622 #T1543.003 #T1027.002 #T1071 #T1057 #T1082 #T1572.001 #T1059.003 #T1566.001 #T1074.001 #T1572 #T1218.011 #T1620 #T1135 #T1049 #T1140 #T1030 #T1005 #T1036.004 #T1041 #T1129 #T1572.002 #T1571 #T1090.002 #T1046 #T1218.010 #T1132 #T1112 #T1083 #T1124 #T1033 #T1095 #T1560.002 #T1090.003 #T1008

View all reports in this cluster