Threat Actor Profile
High APT
Description

Operation Sharpshooter is the name of a cyber espionage campaign discovered in October 2018 targeting nuclear, defense, energy, and financial companies. Though overlaps between this adversary and Lazarus Group have been noted, definitive links have not been established.(Citation: McAfee Sharpshooter December 2018)

Confidence Score
90%
Known Aliases
Sharpshooter
Tags
mitre-attack stix-2.1 intrusion-set
First Seen

Unknown

Last Updated

Unknown

Active Status
Active
Created

April 29, 2026

Indicators of Compromise

Loading IOCs…

IOC KQL for Sentinel
STIX Data
{'aliases': ['Sharpshooter'],
 'created': '2020-05-14T21:40:31.089Z',
 'created_by_ref': 'identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5',
 'description': 'Operation '
                '[Sharpshooter](https://attack.mitre.org/groups/G0104) is the '
                'name of a cyber espionage campaign discovered in October 2018 '
                'targeting nuclear, defense, energy, and financial companies. '
                'Though overlaps between this adversary and [Lazarus '
                'Group](https://attack.mitre.org/groups/G0032) have been '
                'noted, definitive links have not been established.(Citation: '
                'McAfee Sharpshooter December 2018)',
 'external_references': [{'external_id': 'G0104',
                          'source_name': 'mitre-attack',
                          'url': 'https://attack.mitre.org/groups/G0104'},
                         {'description': 'Sherstobitoff, R., Malhotra, A., et. '
                                         'al.. (2018, December 18). Operation '
                                         'Sharpshooter Campaign Targets Global '
                                         'Defense, Critical Infrastructure. '
                                         'Retrieved May 14, 2020.',
                          'source_name': 'McAfee Sharpshooter December 2018',
                          'url': 'https://www.mcafee.com/enterprise/en-us/assets/reports/rp-operation-sharpshooter.pdf'}],
 'id': 'intrusion-set--5e78ae92-3ffd-4b16-bf62-e798529d73f1',
 'modified': '2025-04-18T17:59:28.191Z',
 'name': 'Sharpshooter',
 'object_marking_refs': ['marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168'],
 'revoked': False,
 'spec_version': '2.1',
 'type': 'intrusion-set',
 'x_mitre_attack_spec_version': '3.2.0',
 'x_mitre_deprecated': True,
 'x_mitre_domains': ['enterprise-attack'],
 'x_mitre_modified_by_ref': 'identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5',
 'x_mitre_version': '1.0'}
Quick Actions