Andariel
Andariel is a North Korean state-sponsored threat group that has been active since at least 2009. Andariel has primarily focused its operations--which have included destructive attacks--against South Korean government agencies, military organizations, and a variety of domestic companies; they have also conducted cyber financial operations against ATMs, banks, and cryptocurrency exchanges. Andariel's notable activity includes Operation Black Mine, Operation GoldenAxe, and Campaign Rifle. Andariel is considered a sub-set of Lazarus Group, and has been attributed to North Korea's Reconnaissance General Bureau. North Korean group definitions are known to have significant overlap, and some security researchers report all North Korean state-sponsored cyber activity under the name Lazarus Group instead of tracking clusters or subgroups.
Properties
- Last source
- MITRE ATT&CK
- STIX ID
- intrusion-set--39d6890e-7f23-4474-b8ef-e7b0343c5fc8
- In Signal since
- initial import (Sep 2026)
- Retrieved at
- 2026-11-02T16:56:30+00:00
- Origin source
- attack_description
- Type
- intrusion-set
- Origin country
- KP
MITRE ATT&CK Techniques (12)
Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to
Adversaries may gain access to a system through a user visiting a website over the normal course of browsing. Multiple ways of delivering exploit code
Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding
Adversaries may gather the victim's IP addresses that can be used during targeting. Public IP addresses may be allocated to organizations by block, or
Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external ad
An adversary may rely upon a user opening a malicious file in order to gain execution. Users may be subjected to social engineering to get them to ope
Adversaries may buy, steal, or download malware that can be used during targeting. Malicious software can include payloads, droppers, post-compromise
Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common
Adversaries may gather information about the victim's host software that can be used during targeting. Information about installed software may includ
Adversaries may send spearphishing emails with a malicious attachment in an attempt to gain access to victim systems. Spearphishing attachment is a sp
Adversaries may use steganography techniques in order to prevent the detection of hidden information. Steganographic techniques can be used to hide da
Adversaries may attempt to get a listing of network connections to or from the compromised system they are currently accessing or from remote systems
Software & Tools (2)
Rifdoor is a remote access trojan (RAT) that shares numerous code similarities with [HotCroissant](https://
gh0st RAT is a remote access tool (RAT). The source code is public and it has been used by multiple groups.
Explore this actor's full graph with Ninja Signal