APT38

APT38 is a North Korean (DPRK) state-sponsored threat actor and a subgroup associated in the provided content with BlueNoroff and Lazarus. Reported aliases include BlueNoroff, BeagleBoyz, CageyChameleon, CryptoCore, DangerousPassword, Leery Turtle, Masan, Nickel Tapestry, Sapphire Sleet, TA444, and UNC1069. The content also notes TA444/BlueNoroff/Sapphire Sleet as a DPRK APT subgroup known for targeting cryptocurrencies since at least 2017, and states that UNC1069/CryptoCore may be the successor to what was previously tracked as APT38. The actor is strongly associated with financially motivated operations, especially cryptocurrency theft and major financial heists. The content explicitly cites North Korea’s APT38 as responsible for the 2016 Bank of Bangladesh heist that stole $81 million. Multiple cited reports align APT38/BlueNoroff/Sapphire Sleet/TA444 with cryptocurrency-focused intrusions and digital financial platform targeting. Observed tradecraft in the provided content includes establishing persistence by installing a new Windows service; file and directory discovery on compromised hosts; identifying primary, logged-in, common, and inactive users; command-and-control over HTTP and HTTPS; clipboard theft via the KEYLIME trojan; and phishing that attempts to lure victims into enabling malicious macros in email attachments. Additional reporting in the content aligns APT38 with clusters using sophisticated malware and intrusion chains targeting cryptocurrency organizations, including macOS-focused activity, multi-stage malware, and wallet-targeting operations. The content also states that PHANTOMPULSE tradecraft, targeting, and infrastructure align with DPRK-linked crypto-targeting clusters that include Lazarus, BlueNoroff, UNC5342, and APT38.