APT38

APT38 is a North Korean state-sponsored threat actor active since at least 2014, specializing in financially motivated operations against banks and other financial institutions. Associated tracking names include Bluenoroff, BlueNoroff, Stardust Chollima, and Nickel Gladstone. It shares tools and malware with other North Korean actors, including Lazarus Group and TEMP.Hermit, but is distinguished by its focus on financial theft. Its operations include fraudulent SWIFT transfers, bank fraud, cryptocurrency-exchange intrusions, and cryptocurrency theft. APT38 conducts preparatory reconnaissance of target personnel, infrastructure, and third-party vendors, particularly those connected to SWIFT systems. Documented initial-access methods include watering-hole attacks and exploitation of vulnerable Linux servers. After gaining access, it scans compromised environments, performs internal reconnaissance, and moves toward financial transaction infrastructure. It installs backdoors and reconnaissance malware on SWIFT servers and uses specialized malware to insert fraudulent transactions and manipulate financial data. Its tooling includes Mimikatz for credential theft and NACHOCHEESE for tunneling and remote shell access. Other documented behaviors include keylogging, clipboard collection, command-shell execution, and persistence through Windows services and scheduled tasks. APT38 uses log deletion, file deletion, software packing, and disk wiping to conceal activity and obstruct investigation. It has also deployed Hermes ransomware to encrypt files with AES-256, with encryption and destructive activity used to hinder detection and recovery following financial theft.