Loading threat actor…
APT38 is a North Korea-linked threat actor widely assessed to operate as part of the Lazarus ecosystem and is also tracked as Sapphire Sleet. The group is best known for financially motivated and operationally sophisticated intrusions, particularly against financial institutions, cryptocurrency-related targets, and other organizations that can be leveraged for revenue generation or strategic gain. Its activity aligns with broader Democratic People's Republic of Korea state interests and combines espionage-adjacent tradecraft with theft, supply-chain compromise, and long-duration intrusion operations. APT38 has demonstrated the ability to compromise software supply chains, including campaigns targeting developer ecosystems and package repositories. Reported operations include compromise of npm package supply chains through malicious dependency injection across a large number of packages, reflecting an emphasis on developer trust relationships, downstream victim reach, and stealthy propagation through legitimate software distribution channels. The group employs tradecraft associated with mature intrusion sets, including process injection for privilege escalation and defense evasion, abuse of legitimate services and cloud platforms, and social-engineering-driven initial access. North Korea-linked operations associated with this cluster have used developer platforms, cloud storage services, and collaboration tooling to deliver payloads, stage infrastructure, and blend malicious activity with normal user behavior. Targeting has included developers, cryptocurrency professionals, and security personnel, alongside broader high-value sectors such as government, defense, healthcare, and energy in geopolitically sensitive regions. APT38 is commonly associated with the wider Lazarus constellation of North Korean operators. Security vendors and practitioners may encounter overlapping reporting that places Sapphire Sleet, Lazarus-related subclusters, or financially focused DPRK activity in close relation to APT38. The most widely recognized name in industry usage remains APT38.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Attributed origin per open-source reporting.
No public activity tracked yet. Mallory keeps watching.
No public activity observed for this threat actor.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.