Loading IOCs…

{'aliases': [],
 'description': 'Andarielis a North Korean state-sponsored threat group that '
                'has been active since at least 2009.Andarielhas primarily '
                'focused its operations--which have included destructive '
                'attacks--against South Korean government agencies, military '
                'organizations, and a variety of domestic companies; they have '
                'also conducted cyber financial operations against ATMs, '
                "banks, and cryptocurrency exchanges.Andariel's notable "
                'activity includes Operation Black Mine, Operation GoldenAxe, '
                'and Campaign Rifle.[1][2][3][4][5] Andarielis considered a '
                'sub-set ofLazarus Group, and has been attributed to North '
                "Korea's Reconnaissance General Bureau.[6] North Korean group "
                'definitions are known to have significant overlap, and some '
                'security researchers report all North Korean state-sponsored '
                'cyber activity under the nameLazarus Groupinstead of tracking '
                'clusters or subgroups.',
 'external_references': [{'external_id': 'G0138',
                          'source_name': 'mitre-attack',
                          'url': 'https://attack.mitre.org/groups/G0138/'}],
 'id': 'threat-actor--G0138',
 'metadata': {'crawled_at': '2026-04-29T14:32:24.341615+00:00',
              'mitre_group_id': 'G0138',
              'page_title': 'Andariel, Silent Chollima, PLUTONIUM, Onyx Sleet, '
                            'Group G0138 | MITRE ATT&CK®'},
 'name': 'Andariel',
 'type': 'threat-actor'}