Symantec observed North Korea-linked Stonefly, also known as Andariel, APT45, Silent Chollima, and Onyx Sleet, conducting intrusions against three U.S. private-sector organizations in August 2024 after a U.S. indictment named an alleged group member. The affected companies had no obvious intelligence value, and Symantec assesses the activity was likely financially motivated even though ransomware was not successfully deployed. The intrusions used Stonefly’s custom Backdoor.Preft alongside tools and techniques including Nukebot, Sliver, Chisel, PuTTY, Plink, FRP, Megatools for exfiltration, registry changes enabling plaintext WDigest credentials, and a custom Mimikatz variant writing credentials to a Windows temp log. The excerpt also describes keyloggers, fake or campaign-specific certificates, and hashes for Preft, keyloggers, tunneling tools, credential tools, and other malicious or suspicious files. The activity matters because Stonefly appears to be continuing extortion-oriented operations against U.S. organizations despite law-enforcement exposure and reward pressure.