AdversaryGraph public intelligence page
This page is part of Threat Matrix, the public browser workspace for the main AdversaryGraph platform. Use it for ATT&CK pivots, actor and technique context, similarity leads, detection coverage review, and analyst-ready investigation paths.
Validation disclaimer: TTP overlap, actor similarity, generated summaries, and coverage findings are investigation leads, not attribution proof or operational validation without analyst review.
Main AdversaryGraph project Documentation Malware Analysis GitHub
APT38
Aliases: APT38, BeagleBoyz, Bluenoroff, COPERNICIUM, NICKEL GLADSTONE, Sapphire Sleet, Stardust Chollima
[APT38](https://attack.mitre.org/groups/G0082) is a North Korean state-sponsored threat group that specializes in financial cyber operations; it has been attributed to the Reconnaissance General Bureau.(Citation: CISA AA20-239A BeagleBoyz August 2020) Active since at least 2014, [APT38](https://attack.mitre.org/groups/G0082) has targeted banks, financial institutions, casinos, cryptocurrency exchanges, SWIFT system endpoints, and ATMs in at least 38 countries worldwide. Significant operations include the 2016 Bank of Bangladesh heist, Bancomext (Citation: FireEye APT38 Oct 2018) and Banco de Chile (Citation: FireEye APT38 Oct 2018), along with software supply chain compromises and destructive malware attacks.(Citation: CISA AA20-239A BeagleBoyz August 2020)(Citation: FireEye APT38 Oct 2018)(Citation: DOJ North Korea Indictment Feb 2021)(Citation: Kaspersky Lazarus Under The Hood Blog 2017)(Citation: Microsoft Axios Compromise APR 2026)(Citation: Microsoft Sapphire Sleet APR 2026)(Citation: MIcrosoft Mastra npm Compromise JUN 2026) North Korean group definitions are known to have significant overlap, and some security researchers report all North Korean state-sponsored cyber activity under the name [Lazarus Group](https://attack.mitre.org/groups/G0032) instead of tracking clusters or subgroups.
Open interactive actor investigation
ATT&CK techniques
T1005T1012T1027.002T1027.010T1027.015T1027.016T1033T1036.003T1036.005T1036.006T1036.008T1041T1048.002T1049T1053.003T1053.005T1053.006T1055T1056.001T1056.002T1057T1059.001T1059.002T1059.003T1059.004T1059.005T1059.006T1059.007T1070.003T1070.004T1070.006T1071.001T1074.001T1078.003T1078.004T1082T1083T1105T1106T1110T1112T1115T1124T1132.001T1135T1140T1189T1195.001T1204.001T1204.002T1213.005T1213.006T1217T1218.001T1218.005T1218.007T1218.011T1222.002T1480T1480.002T1485T1486T1505.003T1518T1518.001T1529T1543.001T1543.003T1543.004T1546.016T1547.001T1548.002T1548.003T1548.006T1552.003T1552.004T1553.005T1555T1555.001T1555.003T1560.001T1561.002T1564.003T1564.011T1564.012T1565.001T1565.002T1565.003T1566.001T1566.002T1566.003T1567T1569.002T1571T1583.001T1583.003T1583.006T1585.001T1585.002T1586.003T1588.002T1608.001T1620T1657T1677T1678T1683.001T1683.002T1684.001T1685T1685.003T1685.005T1686T1686.002T1690
Correlated CTI and IR reports
Continue the investigation
Attack tools, simulations and detection rules
Follow explicit source relationships into the reference modules. Linked procedures and detectors are not claims of live validation or actor attribution.
- Mimikatz tool reference — Explicit actor uses software relationship in pinned ATT&CK
- Net tool reference — Explicit actor uses software relationship in pinned ATT&CK
- T1005 Data from Local System simulation — Exact active technique ID
- T1005 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1012 Query Registry simulation — Exact active technique ID
- T1012 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1027.002 Software Packing simulation — Exact active technique ID
- T1027.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1027.010 Command Obfuscation simulation — Exact active technique ID
- T1027.010 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1027.015 Compression simulation — Exact active technique ID
- T1027.015 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1027.016 Junk Code Insertion simulation — Exact active technique ID
- T1027.016 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1033 System Owner/User Discovery simulation — Exact active technique ID
- T1033 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1036.003 Rename Legitimate Utilities simulation — Exact active technique ID
- T1036.003 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1036.005 Match Legitimate Resource Name or Location simulation — Exact active technique ID
- T1036.005 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1036.006 Space after Filename simulation — Exact active technique ID
- T1036.006 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1036.008 Masquerade File Type simulation — Exact active technique ID
- T1036.008 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1041 Exfiltration Over C2 Channel simulation — Exact active technique ID
- T1041 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1048.002 Exfiltration Over Asymmetric Encrypted Non-C2 Protocol simulation — Exact active technique ID
- T1048.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1049 System Network Connections Discovery simulation — Exact active technique ID
- T1049 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1053.003 Cron simulation — Exact active technique ID
- T1053.003 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1053.005 Scheduled Task simulation — Exact active technique ID
- T1053.005 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1053.006 Systemd Timers simulation — Exact active technique ID
- T1053.006 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1055 Process Injection simulation — Exact active technique ID
- T1055 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1056.001 Keylogging simulation — Exact active technique ID
- T1056.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1056.002 GUI Input Capture simulation — Exact active technique ID
- T1056.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1057 Process Discovery simulation — Exact active technique ID
- T1057 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1059.001 PowerShell simulation — Exact active technique ID
- T1059.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1059.002 AppleScript simulation — Exact active technique ID
- T1059.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1059.003 Windows Command Shell simulation — Exact active technique ID
- T1059.003 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1059.004 Unix Shell simulation — Exact active technique ID
- T1059.004 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1059.005 Visual Basic simulation — Exact active technique ID
- T1059.005 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1059.006 Python simulation — Exact active technique ID
- T1059.006 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1059.007 JavaScript simulation — Exact active technique ID
- T1059.007 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1070.003 Clear Command History simulation — Exact active technique ID
- T1070.003 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1070.004 File Deletion simulation — Exact active technique ID
- T1070.004 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1070.006 Timestomp simulation — Exact active technique ID
- T1070.006 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1071.001 Web Protocols simulation — Exact active technique ID
- T1071.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1074.001 Local Data Staging simulation — Exact active technique ID
- T1074.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1078.003 Local Accounts simulation — Exact active technique ID
- T1078.003 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1078.004 Cloud Accounts simulation — Exact active technique ID
- T1078.004 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1082 System Information Discovery simulation — Exact active technique ID
- T1082 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1083 File and Directory Discovery simulation — Exact active technique ID
- T1083 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1105 Ingress Tool Transfer simulation — Exact active technique ID
- T1105 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1106 Native API simulation — Exact active technique ID
- T1106 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1110 Brute Force simulation — Exact active technique ID
- T1110 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1112 Modify Registry simulation — Exact active technique ID
- T1112 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1115 Clipboard Data simulation — Exact active technique ID
- T1115 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1124 System Time Discovery simulation — Exact active technique ID
- T1124 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1132.001 Standard Encoding simulation — Exact active technique ID
- T1132.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1135 Network Share Discovery simulation — Exact active technique ID
- T1135 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1140 Deobfuscate/Decode Files or Information simulation — Exact active technique ID
- T1140 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1189 Drive-by Compromise simulation — Exact active technique ID
- T1189 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1195.001 Compromise Software Dependencies and Development Tools simulation — Exact active technique ID
- T1195.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1204.001 Malicious Link simulation — Exact active technique ID
- T1204.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1204.002 Malicious File simulation — Exact active technique ID
- T1204.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1213.005 Messaging Applications simulation — Exact active technique ID
- T1213.005 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1213.006 Databases simulation — Exact active technique ID
- T1213.006 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1217 Browser Information Discovery simulation — Exact active technique ID
- T1217 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1218.001 Compiled HTML File simulation — Exact active technique ID
- T1218.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1218.005 Mshta simulation — Exact active technique ID
- T1218.005 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1218.007 Msiexec simulation — Exact active technique ID
- T1218.007 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1218.011 Rundll32 simulation — Exact active technique ID
- T1218.011 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1222.002 Linux and Mac Permissions simulation — Exact active technique ID
- T1222.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1480 Execution Guardrails simulation — Exact active technique ID
- T1480 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1480.002 Mutual Exclusion simulation — Exact active technique ID
- T1480.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1485 Data Destruction simulation — Exact active technique ID
- T1485 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1486 Data Encrypted for Impact simulation — Exact active technique ID
- T1486 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1505.003 Web Shell simulation — Exact active technique ID
- T1505.003 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1518 Software Discovery simulation — Exact active technique ID
- T1518 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1518.001 Security Software Discovery simulation — Exact active technique ID
- T1518.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1529 System Shutdown/Reboot simulation — Exact active technique ID
- T1529 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1543.001 Launch Agent simulation — Exact active technique ID
- T1543.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1543.003 Windows Service simulation — Exact active technique ID
- T1543.003 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1543.004 Launch Daemon simulation — Exact active technique ID
- T1543.004 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1546.016 Installer Packages simulation — Exact active technique ID
- T1546.016 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1547.001 Registry Run Keys / Startup Folder simulation — Exact active technique ID
- T1547.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1548.002 Bypass User Account Control simulation — Exact active technique ID
- T1548.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1548.003 Sudo and Sudo Caching simulation — Exact active technique ID
- T1548.003 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1548.006 TCC Manipulation simulation — Exact active technique ID
- T1548.006 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1552.003 Shell History simulation — Exact active technique ID
- T1552.003 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1552.004 Private Keys simulation — Exact active technique ID
- T1552.004 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1553.005 Mark-of-the-Web Bypass simulation — Exact active technique ID
- T1553.005 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1555 Credentials from Password Stores simulation — Exact active technique ID
- T1555 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1555.001 Keychain simulation — Exact active technique ID
- T1555.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1555.003 Credentials from Web Browsers simulation — Exact active technique ID
- T1555.003 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1560.001 Archive via Utility simulation — Exact active technique ID
- T1560.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1561.002 Disk Structure Wipe simulation — Exact active technique ID
- T1561.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1564.003 Hidden Window simulation — Exact active technique ID
- T1564.003 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1564.011 Ignore Process Interrupts simulation — Exact active technique ID
- T1564.011 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1564.012 File/Path Exclusions simulation — Exact active technique ID
- T1564.012 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1565.001 Stored Data Manipulation simulation — Exact active technique ID
- T1565.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1565.002 Transmitted Data Manipulation simulation — Exact active technique ID
- T1565.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1565.003 Runtime Data Manipulation simulation — Exact active technique ID
- T1565.003 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1566.001 Spearphishing Attachment simulation — Exact active technique ID
- T1566.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1566.002 Spearphishing Link simulation — Exact active technique ID
- T1566.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1566.003 Spearphishing via Service simulation — Exact active technique ID
- T1566.003 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1567 Exfiltration Over Web Service simulation — Exact active technique ID
- T1567 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1569.002 Service Execution simulation — Exact active technique ID
- T1569.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1571 Non-Standard Port simulation — Exact active technique ID
- T1571 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1583.001 Domains simulation — Exact active technique ID
- T1583.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1583.003 Virtual Private Server simulation — Exact active technique ID
- T1583.003 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1583.006 Web Services simulation — Exact active technique ID
- T1583.006 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1585.001 Social Media Accounts simulation — Exact active technique ID
- T1585.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1585.002 Email Accounts simulation — Exact active technique ID
- T1585.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1586.003 Cloud Accounts simulation — Exact active technique ID
- T1586.003 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1588.002 Tool simulation — Exact active technique ID
- T1588.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1608.001 Upload Malware simulation — Exact active technique ID
- T1608.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1620 Reflective Code Loading simulation — Exact active technique ID
- T1620 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1657 Financial Theft simulation — Exact active technique ID
- T1657 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1677 Poisoned Pipeline Execution simulation — Exact active technique ID
- T1677 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1678 Delay Execution simulation — Exact active technique ID
- T1678 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1683.001 Written Content simulation — Exact active technique ID
- T1683.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1683.002 Audio-Visual Content simulation — Exact active technique ID
- T1683.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1684.001 Impersonation simulation — Exact active technique ID
- T1684.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1685 Disable or Modify Tools simulation — Exact active technique ID
- T1685 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1685.003 Modify or Spoof Tool UI simulation — Exact active technique ID
- T1685.003 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1685.005 Clear Windows Event Logs simulation — Exact active technique ID
- T1685.005 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1686 Disable or Modify System Firewall simulation — Exact active technique ID
- T1686 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1686.002 Network Device Firewall simulation — Exact active technique ID
- T1686.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1690 Prevent Command History Logging simulation — Exact active technique ID
- T1690 detection rules — Exact active technique ID; not actor-specific detector coverage
Cyber Knowledge routes
These contextual routes explain behaviors associated with this ATT&CK group record. They support learning and investigation planning; they do not add attribution evidence.
Module 4 — Detection engineering and detection as code
Blue Team & Defensive Security · explicit-idModule 11 — Email, web, API, data, and insider defense
Blue Team & Defensive Security · explicit-nameBinary formats, ABI, loaders, and mitigations
Vulnerability Research & Exploit Development · explicit-nameEmbedded, firmware, hardware, and update-chain research
Vulnerability Research & Exploit Development · explicit-nameFiles, parsers, serialization, URL fetching, and isolation
Secure Code & Application Security · explicit-nameImages, video, audio, geolocation, chronolocation, and media verification
OSINT & Reconnaissance · explicit-nameInfrastructure, network, resource, and availability security
AI Security · explicit-nameModule 7 — Privilege, lateral movement, and controlled impact
Red Team & Offensive Security · explicit-nameModule 7 — Endpoint defense and EDR
Blue Team & Defensive Security · explicit-nameControlled dynamic behavior and differential observation
Malware Analysis & Reverse Engineering · explicit-nameWindows endpoint and identity forensics
Digital Forensics & Incident Response (DFIR) · explicit-nameLinux and macOS endpoint forensics
Digital Forensics & Incident Response (DFIR) · explicit-name
Blue Team & Defensive Security · explicit-idModule 11 — Email, web, API, data, and insider defense
Blue Team & Defensive Security · explicit-nameBinary formats, ABI, loaders, and mitigations
Vulnerability Research & Exploit Development · explicit-nameEmbedded, firmware, hardware, and update-chain research
Vulnerability Research & Exploit Development · explicit-nameFiles, parsers, serialization, URL fetching, and isolation
Secure Code & Application Security · explicit-nameImages, video, audio, geolocation, chronolocation, and media verification
OSINT & Reconnaissance · explicit-nameInfrastructure, network, resource, and availability security
AI Security · explicit-nameModule 7 — Privilege, lateral movement, and controlled impact
Red Team & Offensive Security · explicit-nameModule 7 — Endpoint defense and EDR
Blue Team & Defensive Security · explicit-nameControlled dynamic behavior and differential observation
Malware Analysis & Reverse Engineering · explicit-nameWindows endpoint and identity forensics
Digital Forensics & Incident Response (DFIR) · explicit-nameLinux and macOS endpoint forensics
Digital Forensics & Incident Response (DFIR) · explicit-name
Related sector research
Editorial reading routes, not additional MITRE relationships or proof of an actor's involvement in a particular incident.
- Cyberattacks on Big Pharma and Its Ecosystem — Comparison of distinct actor records only; not attribution of a pharmaceutical incident to APT38. Evidence cutoff: 2026-09-25.