ThreatRoundup

APT38 (BlueNoroff)

North Korean RGB unit that steals money: SWIFT bank heists like Bangladesh Bank, FASTCash ATM cash-outs, then crypto theft via fake VC calls, deepfake meetings and npm supply chains.

Threat actor profile · Updated

Active
2014 to November 2026
Origin
North Korea (Reconnaissance General Bureau)
Type
State-sponsored
Affiliates
Reconnaissance General Bureau (RGB); Lazarus Group (parent or sibling, as vendors differ); BeagleBoyz (US government); Sapphire Sleet (Microsoft, folded into APT38 by MITRE); TA444 (Proofpoint); TraderTraitor (link disputed)
Regions targeted
Global: South and Southeast Asia, Latin America, Africa, Europe, Taiwan, Japan, United States, Canada, UAE, global cryptocurrency and Web3 sector
MITRE ATT&CK
G0082

What each vendor calls it

Microsoft
COPERNICIUMSapphire Sleet
CrowdStrike
Genie SpiderStardust Chollima
Google / Mandiant
APT38
Palo Alto Unit 42
Alluring Pisces
Sophos / Secureworks
NICKEL GLADSTONE
Kaspersky
Bluenoroff

Also known as BeagleBoyz US governmentCageyChameleon

See this actor in the Threat Actor Rosetta Stone →

Profile

APT38 is the North Korean state hacking team whose job is to steal money. MITRE ATT&CK describes it as a financially focused group attributed to the Reconnaissance General Bureau (RGB), active since at least 2014, that has gone after banks, SWIFT endpoints, ATM networks, casinos and cryptocurrency exchanges in at least 38 countries. The US government formally names the same unit: in September 2019 the Treasury Department sanctioned Bluenoroff (Kaspersky’s name for it) as an RGB-controlled sub-group of Lazarus Group set up to raise money as sanctions tightened, and in February 2021 the Justice Department indicted three RGB military hackers over a scheme spanning bank heists and cryptocurrency theft.

How APT38 relates to Lazarus Group depends on who you ask. Mandiant, which coined the APT38 name in its October 2018 report APT38: Un-usual Suspects, split it out from the broader “Lazarus” activity (which it tracks as TEMP.Hermit) because its money-making mission, tools and targets are distinct, while noting shared malware developers and shared personnel. Kaspersky and the US Treasury instead call Bluenoroff a smaller sub-group of Lazarus. CISA’s 2020 BeagleBoyz advisory says the US government’s bank-robbing team overlaps in varying degrees with APT38, Bluenoroff, Lazarus and Stardust Chollima, and the FBI has repeatedly named “Lazarus Group (also known as APT38)” when pinning a cryptocurrency theft on Pyongyang, for example the $41 million Stake.com theft. This page covers the financial cluster MITRE calls APT38, including the Microsoft-named Sapphire Sleet activity MITRE now folds into it; the Lazarus page covers the espionage, sabotage and Dream Job side.

The early years were about banks. Mandiant says the group spent most of 2014 learning bank systems (it found the NESTEGG backdoor and KEYLIME keylogger at a Southeast Asian bank with no fraudulent transfers), attempted its first heist at Vietnam’s TPBank in December 2015, and then hit Bangladesh Bank in February 2016. Treasury says that operation used stolen SWIFT credentials to request $851 million and got away with about $80 million before a typo tipped off staff. BAE Systems found the malware patched two bytes of the SWIFT Alliance Access software and doctored the printed confirmations so staff wouldn’t see the fraud. Mandiant measured an average dwell time of about 155 days and found the group careful to the point of patience: map the SWIFT environment, wait, then strike.

The other signature is destruction as cover. Mandiant says APT38 wipes logs with tools like SCRUBBRUSH and CLEANTOAD, then wipes machines with BOOTWRECK, and in one incident left close to 10,000 workstations and servers unusable. CISA ties a 2018 wiper attack on a Chilean bank to the BeagleBoyz, BAE found Hermes ransomware dropped during the October 2017 Far Eastern International Bank heist in Taiwan, and ESET found KillDisk on more than 100 machines at a Central American online casino. Alongside SWIFT fraud the US government documents FASTCash, a scheme that compromises bank payment-switch servers to approve fraudulent ATM withdrawals: CISA counted simultaneous cash-outs in more than 30 countries in 2017 and 23 in 2018, and by 2020 a Windows version and attacks on regional payment processors.

From about 2017 the money moved to cryptocurrency. Kaspersky’s SnatchCrypto research describes BlueNoroff impersonating venture capital firms, sending booby-trapped pitch decks and NDAs to crypto and DeFi startups, watching victims for weeks, then swapping in a tampered MetaMask extension that quietly rewrote transaction recipients so hardware-wallet users signed away their own funds. Proofpoint, which tracks the group as TA444, compares it to a tech startup for how often it tries new file types, delivery tricks and lures.

Since 2023 the target has been the people who hold the keys, increasingly on Macs. Jamf, Elastic and SentinelOne followed a stream of macOS malware (RustBucket, ObjCShellz and the “Hidden Risk” backdoor, which used a never-before-seen ~/.zshenv persistence trick). Microsoft says Sapphire Sleet poses as venture capitalists whose video meeting mysteriously fails, then sends a script to fix the connection, or as recruiters with a skills test, and estimated it stole more than $10 million in six months. In 2025 the fake meeting got faces: Huntress described deepfaked executives on a fake Zoom call, and Kaspersky’s GhostCall research found the convincing “participants” were real recordings of earlier victims, replayed to hook the next one. Arctic Wolf’s April 2026 report found 100 more people whose likeness the group had harvested for lures.

The newest shift is the software supply chain. Microsoft attributes to Sapphire Sleet the March 31, 2026 poisoning of the axios npm package, one of the most downloaded JavaScript libraries, and, with high confidence, the June 2026 takeover of a maintainer account that pushed a malicious dependency into more than 140 Mastra packages. Both ran payloads at install time, so any developer laptop or CI pipeline that ran npm install was exposed. On Oct. 29, 2026, Binance lost about $6.36 billion, which TRM Labs attributes to the North Korean unit it calls TraderTraitor. Vendors don’t agree on whether TraderTraitor sits inside APT38 or beside it, so treat that link as unsettled.

Naming is a mess. Kaspersky says Bluenoroff, Microsoft Sapphire Sleet (formerly COPERNICIUM), CrowdStrike Stardust Chollima, Secureworks NICKEL GLADSTONE, Proofpoint TA444, Palo Alto Networks Unit 42 Alluring Pisces, and the US government BeagleBoyz (full list above).

Events

Date Target Narrative Source Our coverage
2025 to 2026-11 People in crypto, Web3 and finance, plus open-source maintainers (Arctic Wolf counts 677 targets in 58 countries) FaceStealer: hijacked Telegram, LinkedIn, Slack or Discord accounts invite the owner’s contacts to typosquatted Zoom or Teams calls, T1586.001 (Compromise Accounts: Social Media Accounts), T1566.003 (Phishing: Spearphishing via Service), where recorded video and deepfakes stand in for the contact and a fake audio error leads to a pasted command, T1204.004 (User Execution: Malicious Copy and Paste). The FBI says the scheme took more than $400 million in crypto over 18 months and has seized its infrastructure and 900+ victim recordings; attribution to BlueNoroff is per the reporting. FBI, US Justice Department Our story
2026-10-29 Binance cryptocurrency exchange About $6.36 billion drained in roughly 20 minutes after a DevOps engineer’s laptop was compromised, T1657 (Financial Theft). TRM Labs attributes it with high confidence to TraderTraitor; whether that unit falls under the APT38 label is disputed between vendors. TRM Labs, Chainalysis Our story
2026-06-17 Developers and CI/CD pipelines using Mastra npm packages A hijacked maintainer account adds the typosquat easy-day-js to 140+ Mastra packages; its postinstall dropper fetches a Node.js implant that checks for 166 crypto wallet extensions, T1195.002 (Supply Chain Compromise: Compromise Software Supply Chain). Microsoft attributes it to Sapphire Sleet with high confidence. Microsoft
2026 (early) to 2026-06 macOS users at finance, crypto and venture capital firms Fake recruiters and technical interviews deliver “Zoom SDK Update.scpt” (later a Teams variant), T1059.002 (Command and Scripting Interpreter: AppleScript); a fake system update prompt steals the password, T1056.002 (Input Capture: GUI Input Capture), and wallets, keychains and SSH keys are exfiltrated. Microsoft
2026-03-31 Users of the axios JavaScript library axios 1.14.1 and 0.30.4 published with a malicious plain-crypto-js dependency whose install script drops an OS-specific RAT. Microsoft attributes the campaign to Sapphire Sleet. Microsoft
2026-01-23 North American Web3/cryptocurrency company A Calendly invite from a fake legal executive leads to a fake Zoom call and a ClickFix “SDK deprecated” prompt, T1204.004 (User Execution: Malicious Copy and Paste). Fileless PowerShell, browser credential and Telegram session theft; 66 days of persistence. Arctic Wolf attributes it to BlueNoroff with high confidence. Arctic Wolf
2025-04 to 2025-09 Tech and venture capital executives; Web3 developers GhostCall (fake investor calls via compromised Telegram accounts, replayed video of earlier victims, fake Zoom then Teams updates) and GhostHire (fake recruiter with a timed GitHub coding test). Kaspersky says both campaigns date back to mid-2023. Kaspersky
2025-06 Employee of a tech firm in the cryptocurrency sector Huntress finds a Telegram contact, a Calendly link and a fake Zoom meeting with deepfaked senior leaders; a “Zoom fix” AppleScript installs eight binaries including the Root Troy V4 backdoor and the CryptoBot wallet stealer. BleepingComputer (Huntress research)
2024-07 to 2024-10 Cryptocurrency-related businesses using macOS “Hidden Risk”: phishing emails about a Bitcoin price surge deliver a notarized Swift dropper and a C++ backdoor that persists through ~/.zshenv, T1546.004 (Event Triggered Execution: Unix Shell Configuration Modification). SentinelOne
2024 (six months to Nov.) Cryptocurrency companies Microsoft estimates Sapphire Sleet stole more than $10 million using fake venture-capitalist meetings (a “connection fix” script) and fake recruiter skills assessments on LinkedIn, T1566.003 (Phishing: Spearphishing via Service). Microsoft
2023-04 to 2023-11 US crypto payroll and B2B payments company; macOS users RustBucket malware posing as a PDF viewer for a fake VC pitch, later updated with a LaunchAgent, T1543.001 (Create or Modify System Process: Launch Agent); ObjCShellz follows on a fake SwissBorg domain. Jamf, Elastic, Jamf
2022-12 Education, government, healthcare and finance in the US and Canada A OneDrive-themed credential-harvesting wave that nearly doubled Proofpoint’s TA444 email volume for 2022, attributed with moderate to moderately high confidence; an unusual move outside crypto. Proofpoint
2022-09 to 2022-10 UAE home-financing company; suspected Japanese targets ISO and VHD disk images used to dodge Windows security warnings, T1553.005 (Subvert Trust Controls: Mark-of-the-Web Bypass), with more than 70 domains imitating Japanese banks and VC firms. Kaspersky
2017 to 2021 Crypto, DeFi and fintech startups in Europe, Asia and the US SnatchCrypto: fake VC documents exploit CVE-2017-0199 or carry malicious shortcut files, T1566.001 (Phishing: Spearphishing Attachment); a tampered MetaMask extension rewrites transfers, T1565.002 (Data Manipulation: Transmitted Data Manipulation). Kaspersky
2020-02 to 2020-08 Banks and interbank payment processors in 38 countries CISA says the BeagleBoyz resumed bank targeting after a late-2019 lull, with FASTCash 2.0 adding Windows malware and regional payment processors, plus job-themed phishing. CISA AA20-239A
2019-09 Not applicable (sanctions) Treasury sanctions Bluenoroff, Lazarus Group and Andariel as RGB-controlled entities. US Treasury
2018-05 Banco de Chile Heist that Mandiant attributes to APT38; CISA describes a 2018 Chilean bank attack in which wiper malware crashed thousands of computers, T1561.002 (Disk Wipe: Disk Structure Wipe). Mandiant, CISA
2018-01 Bancomext (Mexico) Attempted heist attributed by Mandiant to APT38. Mandiant
2017 (late) to 2018 Online casino in Central America KillDisk wiper on more than 100 machines alongside NukeSped backdoors and a modified Mimikatz, T1485 (Data Destruction). ESET attributes it to Lazarus; MITRE lists it under APT38. ESET
2017-10 Far Eastern International Bank (Taiwan) Fraudulent SWIFT transfers routed to Sri Lanka and Cambodia; Hermes ransomware dropped, likely as a distraction, T1486 (Data Encrypted for Impact). BAE saw Lazarus hallmarks; Mandiant attributes it to APT38. BAE Systems
2016-10 to 2017-02 Banks in Poland, Mexico, Uruguay and other countries Watering holes on the Polish financial regulator’s (KNF) website and Latin American sites, T1189 (Drive-by Compromise), using the SMOOTHRIDE Flash exploit loader. Kaspersky, Mandiant
2016 (late) to 2018 Banks in Africa and Asia FASTCash: compromised payment-switch servers approve fraudulent ATM withdrawals, with cash pulled at once in more than 30 countries (2017) and 23 countries (2018). CISA TA18-275A
2016-02 Bangladesh Bank Stolen SWIFT credentials used to request $851 million; about $80 million lost. Malware altered SWIFT database records and printed confirmations, T1565.001 (Data Manipulation: Stored Data Manipulation). US Treasury, BAE Systems
2015-12 TPBank (Vietnam) Attempted heist; Mandiant dates DYEPACK, its SWIFT transaction-hijacking malware, to the same month. Mandiant
2014-02 Southeast Asian bank First known APT38 operation per Mandiant: NESTEGG backdoor and KEYLIME keylogger, with no fraudulent transfers, suggesting a learning phase. Mandiant

Target vectors risk profile

Finance Payments/SWIFT Crypto/DeFi Software supply chain Technology/SaaS Gaming/casinos Disruption/wiper Government Healthcare Education/research Ransomware/extortion Defense
High High High High Medium Medium Medium Low Low Low Low N/A

Malware and tools

Name What it does Public detection Hunt Leads Reports
Mastra and axios npm droppers (easy-day-js, plain-crypto-js) Install-time scripts that pull OS-specific RATs and a Node.js tasking implant onto developer machines and CI runners Indicators in Microsoft’s reports Microsoft, Microsoft
Sapphire Sleet macOS chain (systemupdate.app, services, icloudz) AppleScript lure, fake password prompt, TCC tampering and Mach-O backdoors that load payloads in memory Indicators in Microsoft’s report Microsoft
ZoomClutch, TeamsClutch, DownTroy, CosmicDoor, RooTroy, SilentSiphon GhostCall/GhostHire toolset: fake meeting-app password prompts, multi-language backdoors and a stealer for wallets, keychains and cloud credentials Indicators in Kaspersky’s report Kaspersky
Root Troy V4, CryptoBot Go backdoor and a wallet stealer covering 20+ crypto platforms, dropped after a deepfake Zoom call Indicators in Huntress’s research BleepingComputer
RustBucket, ObjCShellz, Hidden Risk backdoor macOS downloaders and backdoors behind fake PDF viewers and crypto-news lures Elastic YARA rule Elastic, Jamf, SentinelOne
CageyChameleon (CabbageRAT), Cardinal, Cur1Agent Victim-profiling framework and backdoors from TA444’s 2022 Windows campaigns Indicators in Proofpoint’s report Proofpoint
SnatchCrypto toolset (PowerShell agents, tampered MetaMask) Profiling agents, a full Windows backdoor and a modified wallet extension that rewrites transfers Indicators in Kaspersky’s report Kaspersky
HOPLIGHT Backdoor and proxy that hides its traffic behind fake TLS sessions YARA rules in CISA AR19-100A CISA
ECCENTRICBANDWAGON Keylogger and screen-capture reconnaissance tool YARA rule in CISA AR20-239A CISA
FASTCash (AIX and Windows), CROWDEDFLOUNDER, ELECTRICFISH, COPPERHEDGE Payment-switch malware that forges ATM approvals, plus RATs and tunnelling tools used in bank intrusions Indicators in CISA AA20-239A CISA, CISA
DYEPACK SWIFT transaction hijacker that alters records and hides fraudulent transfers from printouts and PDFs None published Mandiant, BAE Systems
NESTEGG, KEYLIME, SMOOTHRIDE Early backdoor and keylogger, and a Flash exploit loader served from watering holes None published Mandiant
BOOTWRECK, SCRUBBRUSH, CLEANTOAD, KillDisk, Hermes ransomware Wipers, log and malware cleanup tools, and ransomware used to destroy evidence after heists Indicators in ESET’s and BAE’s reports Mandiant, ESET, BAE Systems

Reports

Date Source Report
2026-10-30 TRM Labs North Korea steals USD 6.36 billion from Binance in the largest hack in history
2026-06-17 Microsoft From package to postinstall payload: inside the Mastra npm supply chain compromise by Sapphire Sleet
2026-04-27 Arctic Wolf BlueNoroff uses ClickFix, fileless PowerShell, and AI-generated fake Zoom meetings to target Web3 sector
2026-04-16 Microsoft Dissecting Sapphire Sleet’s macOS intrusion from lure to compromise
2026-04-01 Microsoft Mitigating the Axios npm supply chain compromise
2025-10-28 Kaspersky BlueNoroff’s latest campaigns: GhostCall and GhostHire
2025-06-18 BleepingComputer (Huntress research) North Korean hackers deepfake execs in Zoom call to spread Mac malware
2024-11-22 Microsoft Microsoft shares latest intelligence on North Korean and Chinese threat actors at CYBERWARCON
2024-11 SentinelOne BlueNoroff Hidden Risk: threat actor targets Macs with fake crypto news and novel persistence
2023-11-06 Jamf BlueNoroff strikes again with new macOS malware
2023-07-14 Elastic DPRK strikes using a new variant of RUSTBUCKET
2023-04-21 Jamf BlueNoroff APT group targets macOS with RustBucket malware
2023-01-25 Proofpoint TA444: the APT startup aimed at acquisition (of your funds)
2022-12-27 Kaspersky BlueNoroff introduces new methods bypassing MoTW
2022-01-13 Kaspersky The BlueNoroff cryptocurrency hunt is still on
2021-02-17 US Justice Department Three North Korean military hackers indicted in wide-ranging scheme
2020-08-26 CISA, FBI, Treasury, US Cyber Command FASTCash 2.0: North Korea’s BeagleBoyz robbing banks
2019-09-13 US Treasury Treasury sanctions North Korean state-sponsored malicious cyber groups
2018-10-03 Mandiant APT38: Un-usual Suspects
2018-10-02 CISA, FBI, Treasury HIDDEN COBRA: FASTCash campaign
2018-04-06 CrowdStrike Meet CrowdStrike’s Adversary of the Month for April: STARDUST CHOLLIMA
2018-04-03 ESET Lazarus KillDisks Central American casino
2017-10-16 BAE Systems Taiwan heist: Lazarus tools and ransomware
2017-04-03 Kaspersky Lazarus under the hood
2016-04-25 BAE Systems Two bytes to $951m

Vulnerabilities exploited

Vulnerability CVSS Severity Publisher Platform CISA KEV
CVE-2017-0199 7.8 High Microsoft Office and WordPad (remote template injection in SnatchCrypto documents) Yes
CVE-2016-4119 9.8 Critical Adobe Listed by Mandiant among SMOOTHRIDE’s exploits; NVD describes it as an Adobe Reader and Acrobat flaw No
CVE-2016-1019 9.8 Critical Adobe Flash Player (SMOOTHRIDE watering-hole loader) Yes
CVE-2015-8651 8.8 High Adobe Flash Player (SMOOTHRIDE watering-hole loader) Yes

If you’re in their sights

Do this now

  1. Teach staff that a video call which “won’t connect” followed by a script, SDK update or command to paste is the attack itself. No real Zoom or Teams fix arrives as an AppleScript, .vbs file or PowerShell one-liner. This lure has run since at least 2023 against crypto, VC and tech executives.
  2. Lock down npm installs: commit lockfiles, use npm ci, turn off install scripts in CI where you can, and check publish provenance. If you installed axios 1.14.1 or 0.30.4 or mastra 1.13.1, treat that machine or runner as compromised and rotate every secret it could reach.
  3. If you run payments, follow SWIFT’s Customer Security Programme, isolate SWIFT and card-switch servers (including old AIX boxes) from the office network, and reconcile transfers against an independent statement, not a local printout. DYEPACK was built to hide fraud from exactly those printouts.
  4. Put hardware-backed signing and a second approver outside the signer’s own laptop on every hot wallet and withdrawal path, and check browser wallet extensions for developer-mode or sideloaded copies, the trick behind the tampered MetaMask.
  5. On Macs, alert on new LaunchAgents and LaunchDaemons, changes to ~/.zshenv, edits to the TCC database, and osascript fetching code with curl.

Compiled from US Treasury, Justice Department and CISA actions, Mandiant, Microsoft, Kaspersky, Arctic Wolf, Huntress, SentinelOne, Jamf, Elastic, Proofpoint, ESET, BAE Systems, TRM Labs, Chainalysis and MITRE ATT&CK, plus ThreatRoundup reporting. Last reviewed November 14, 2026.

ATT&CK techniques (115)

Techniques MITRE ATT&CK links to this group from public reporting, grouped by tactic. A technique can sit under more than one tactic.

Resource Development 10
Initial Access 7
Execution 15
Persistence 12
Privilege Escalation 14
Stealth 27
Defense Impairment 9
Credential Access 8
Discovery 11
Collection 8
Command and Control 4
Exfiltration 3
Impact 8

Software MITRE links to this group (6)

DarkComet ECCENTRICBANDWAGON HOPLIGHT KillDisk Mimikatz Net

ThreatRoundup coverage

1 of these story has Hunt Leads: detection-ready leads for threat hunters.

ATT&CK techniques and software from MITRE ATT&CK (v20.0); vendor names from MITRE ATT&CK and the MISP galaxy. © The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MISP galaxy content is CC0 / BSD-2-Clause.