Home / Threat actors / APT38

APT38 G0082

🔔 Create alert

Also known as: NICKEL GLADSTONE, BeagleBoyz, Bluenoroff, Stardust Chollima, Sapphire Sleet, COPERNICIUM

Updated at source on Oct 9, 2026 · View on MITRE ATT&CK

0

associated CVEs

136

Techniques

6

Malware and tools

APT38 is a North Korean state-sponsored threat group that specializes in financial cyber operations; it has been attributed to the Reconnaissance General Bureau. Active since at least 2014, APT38 has targeted banks, financial institutions, casinos, cryptocurrency exchanges, SWIFT system endpoints, and ATMs in at least 38 countries worldwide. Significant operations include the 2016 Bank of Bangladesh heist, Bancomext and Banco de Chile, along with software supply chain compromises and destructive malware attacks.

North Korean group definitions are known to have significant overlap, and some security researchers report all North Korean state-sponsored cyber activity under the name Lazarus Group instead of tracking clusters or subgroups.

Exploited vulnerabilities

CVEs cited by MITRE ATT&CK for this group, with the source excerpt. Records not yet published here appear without a link.

ATT&CK does not cite CVEs for this group.

Techniques by tactic

Resource Development

T1583.001 Domains T1583.003 Virtual Private Server T1583.006 Web Services T1585.001 Social Media Accounts T1585.002 Email Accounts T1586.003 Cloud Accounts T1588.002 Tool T1608.001 Upload Malware T1683.001 Written Content T1683.002 Audio-Visual Content

Initial Access

T1078.003 Local Accounts T1078.004 Cloud Accounts T1189 Drive-by Compromise T1195.001 Compromise Software Dependencies and Development Tools T1566.001 Spearphishing Attachment T1566.002 Spearphishing Link T1566.003 Spearphishing via Service

Execution

T1053.003 Cron T1053.005 Scheduled Task T1053.006 Systemd Timers T1059.001 PowerShell T1059.002 AppleScript T1059.003 Windows Command Shell T1059.004 Unix Shell T1059.005 Visual Basic T1059.006 Python T1059.007 JavaScript T1106 Native API T1204.001 Malicious Link T1204.002 Malicious File T1569.002 Service Execution T1677 Poisoned Pipeline Execution

Persistence

T1053.003 Cron T1053.005 Scheduled Task T1053.006 Systemd Timers T1078.003 Local Accounts T1078.004 Cloud Accounts T1112 Modify Registry T1505.003 Web Shell T1543.001 Launch Agent T1543.003 Windows Service T1543.004 Launch Daemon T1546.016 Installer Packages T1547.001 Registry Run Keys / Startup Folder

Privilege Escalation

T1053.003 Cron T1053.005 Scheduled Task T1053.006 Systemd Timers T1055 Process Injection T1078.003 Local Accounts T1078.004 Cloud Accounts T1543.001 Launch Agent T1543.003 Windows Service T1543.004 Launch Daemon T1546.016 Installer Packages T1547.001 Registry Run Keys / Startup Folder T1548.002 Bypass User Account Control T1548.003 Sudo and Sudo Caching T1548.006 TCC Manipulation

Stealth

T1027.002 Software Packing T1027.010 Command Obfuscation T1027.015 Compression T1027.016 Junk Code Insertion T1036.003 Rename Legitimate Utilities T1036.005 Match Legitimate Resource Name or Location T1036.006 Space after Filename T1036.008 Masquerade File Type T1055 Process Injection T1070.003 Clear Command History T1070.004 File Deletion T1070.006 Timestomp T1078.003 Local Accounts T1078.004 Cloud Accounts T1140 Deobfuscate/Decode Files or Information T1218.001 Compiled HTML File T1218.005 Mshta T1218.007 Msiexec T1218.011 Rundll32 T1480 Execution Guardrails T1480.002 Mutual Exclusion T1564.003 Hidden Window T1564.011 Ignore Process Interrupts T1564.012 File/Path Exclusions T1620 Reflective Code Loading T1678 Delay Execution T1684.001 Impersonation

Defense Impairment

T1112 Modify Registry T1222.002 Linux and Mac Permissions T1553.005 Mark-of-the-Web Bypass T1685 Disable or Modify Tools T1685.003 Modify or Spoof Tool UI T1685.005 Clear Windows Event Logs T1686 Disable or Modify System Firewall T1686.002 Network Device Firewall T1690 Prevent Command History Logging

Credential Access

T1056.001 Keylogging T1056.002 GUI Input Capture T1110 Brute Force T1552.003 Shell History T1552.004 Private Keys T1555 Credentials from Password Stores T1555.001 Keychain T1555.003 Credentials from Web Browsers

Discovery

T1012 Query Registry T1033 System Owner/User Discovery T1049 System Network Connections Discovery T1057 Process Discovery T1082 System Information Discovery T1083 File and Directory Discovery T1124 System Time Discovery T1135 Network Share Discovery T1217 Browser Information Discovery T1518 Software Discovery T1518.001 Security Software Discovery

Collection

T1005 Data from Local System T1056.001 Keylogging T1056.002 GUI Input Capture T1074.001 Local Data Staging T1115 Clipboard Data T1213.005 Messaging Applications T1213.006 Databases T1560.001 Archive via Utility

Command and Control

T1071.001 Web Protocols T1105 Ingress Tool Transfer T1132.001 Standard Encoding T1571 Non-Standard Port

Exfiltration

T1041 Exfiltration Over C2 Channel T1048.002 Exfiltration Over Asymmetric Encrypted Non-C2 Protocol T1567 Exfiltration Over Web Service

Impact

T1485 Data Destruction T1486 Data Encrypted for Impact T1529 System Shutdown/Reboot T1561.002 Disk Structure Wipe T1565.001 Stored Data Manipulation T1565.002 Transmitted Data Manipulation T1565.003 Runtime Data Manipulation T1657 Financial Theft

Malware and tools

DarkCometMalwareS0334
ECCENTRICBANDWAGONMalwareS0593
HOPLIGHTMalwareS0376
KillDiskMalwareS0607
MimikatzToolS0002
NetToolS0039

© The MITRE Corporation. ATT&CK® content reproduced and distributed with the permission of The MITRE Corporation.