Picus profiles Andariel, also known as Onyx Sleet, as a North Korea-linked APT associated with the Reconnaissance General Bureau. The source says the group targets defense, aerospace, nuclear and engineering organizations for espionage and also conducts ransomware operations against U.S. healthcare organizations to fund activity. Andariel gains access through spear phishing and exploitation of public-facing web servers, then uses discovery commands, web shells, scheduled tasks, custom malware, RATs and open-source tools for persistence, lateral movement and exfiltration. The TTP section calls out credential dumping with Mimikatz, ProcDump and Dumpert, AD enumeration with AdFind, tunneling through 3Proxy, PLINK and Stunnel, and exfiltration through web services, PuTTY, WinSCP and FTP.