Threat Actor Profile
High
APT
Description
Operation Sharpshooter is the name of a cyber espionage campaign discovered in October 2018 targeting nuclear, defense, energy, and financial companies. Though overlaps between this adversary and Lazarus Group have been noted, definitive links have not been established.(Citation: McAfee Sharpshooter December 2018)
Confidence Score
Known Aliases
Sharpshooter
Tags
mitre-attack
stix-2.1
intrusion-set
First Seen
Unknown
Last Updated
Unknown
Active Status
ActiveCreated
April 29, 2026
Indicators of Compromise
Loading IOCs…
IOC KQL for Sentinel
STIX Data
{'aliases': ['Sharpshooter'],
'created': '2020-05-14T21:40:31.089Z',
'created_by_ref': 'identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5',
'description': 'Operation '
'[Sharpshooter](https://attack.mitre.org/groups/G0104) is the '
'name of a cyber espionage campaign discovered in October 2018 '
'targeting nuclear, defense, energy, and financial companies. '
'Though overlaps between this adversary and [Lazarus '
'Group](https://attack.mitre.org/groups/G0032) have been '
'noted, definitive links have not been established.(Citation: '
'McAfee Sharpshooter December 2018)',
'external_references': [{'external_id': 'G0104',
'source_name': 'mitre-attack',
'url': 'https://attack.mitre.org/groups/G0104'},
{'description': 'Sherstobitoff, R., Malhotra, A., et. '
'al.. (2018, December 18). Operation '
'Sharpshooter Campaign Targets Global '
'Defense, Critical Infrastructure. '
'Retrieved May 14, 2020.',
'source_name': 'McAfee Sharpshooter December 2018',
'url': 'https://www.mcafee.com/enterprise/en-us/assets/reports/rp-operation-sharpshooter.pdf'}],
'id': 'intrusion-set--5e78ae92-3ffd-4b16-bf62-e798529d73f1',
'modified': '2025-04-18T17:59:28.191Z',
'name': 'Sharpshooter',
'object_marking_refs': ['marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168'],
'revoked': False,
'spec_version': '2.1',
'type': 'intrusion-set',
'x_mitre_attack_spec_version': '3.2.0',
'x_mitre_deprecated': True,
'x_mitre_domains': ['enterprise-attack'],
'x_mitre_modified_by_ref': 'identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5',
'x_mitre_version': '1.0'}