APT38 G0082

Overview 2,115 indicators

APT38 is a North Korean state-sponsored threat group that specializes in financial cyber operations; it has been attributed to the Reconnaissance General Bureau. Active since at least 2014, APT38 has targeted banks, financial institutions, casinos, cryptocurrency exchanges, SWIFT system endpoints, and ATMs in at least 38 countries worldwide. Significant operations include the 2016 Bank of Bangladesh heist, during which APT38 stole $81 million, as well as attacks against Bancomext and Banco de Chile ; some of their attacks have been destructive. North Korean group definitions are known to have significant overlap, and some security researchers report all North Korean state-sponsored cyber activity under the name Lazarus Group instead of tracking clusters or subgroups.

Techniques 56 ATT&CK

Open in ATT&CK Navigator → or download the layer (56 techniques, layer 4.5)

• T1005 Data from Local System
• T1027.002 Software Packing
• T1033 System Owner/User Discovery
• T1036.003 Rename Legitimate Utilities
• T1036.006 Space after Filename
• T1049 System Network Connections Discovery
• T1053.003 Cron
• T1053.005 Scheduled Task
• T1055 Process Injection
• T1056.001 Keylogging
• T1057 Process Discovery
• T1059.001 PowerShell
• T1059.003 Windows Command Shell
• T1059.005 Visual Basic
• T1070.004 File Deletion
• T1070.006 Timestomp
• T1071.001 Web Protocols
• T1082 System Information Discovery
• T1083 File and Directory Discovery
• T1105 Ingress Tool Transfer
• T1106 Native API
• T1110 Brute Force
• T1112 Modify Registry
• T1115 Clipboard Data
• T1135 Network Share Discovery
• T1140 Deobfuscate/Decode Files or Information
• T1189 Drive-by Compromise
• T1204.001 Malicious Link
• T1204.002 Malicious File
• T1217 Browser Information Discovery
• T1218.001 Compiled HTML File
• T1218.005 Mshta
• T1218.007 Msiexec
• T1218.011 Rundll32
• T1480.002 Mutual Exclusion
• T1485 Data Destruction
• T1486 Data Encrypted for Impact
• T1505.003 Web Shell
• T1518.001 Security Software Discovery
• T1529 System Shutdown/Reboot
• T1543.003 Windows Service
• T1548.002 Bypass User Account Control
• T1553.005 Mark-of-the-Web Bypass
• T1561.002 Disk Structure Wipe
• T1565.001 Stored Data Manipulation
• T1565.002 Transmitted Data Manipulation
• T1565.003 Runtime Data Manipulation
• T1566.001 Spearphishing Attachment
• T1569.002 Service Execution
• T1583.001 Domains
• T1588.002 Tool
• T1685 Disable or Modify Tools
• T1685.005 Clear Windows Event Logs
• T1686 Disable or Modify System Firewall
• T1686.002 Network Device Firewall
• T1690 Prevent Command History Logging

Software 6

• Mimikatz
• Net
• DarkComet
• HOPLIGHT
• ECCENTRICBANDWAGON
• KillDisk

Principal sources 175 reports

Ranked by how many of this actor's indicators each report brought in.

• 323jumpsec.com/guides/inside-a-dprk-bluenoroff-clickfi…
• 202x.com/TMJ0x/status/2014582284125421571
• 202virustotal.com/gui/ip-address/188.227.196.252/relations
• 202virustotal.com/gui/ip-address/188.227.197.32/relations
• 171twitter.com/e_kaspersky/status/1481665686351106053
• 171securelist.com/the-bluenoroff-cryptocurrency-hunt-is-s…
• 167x.com/ValidinLLC/status/1943648048401244489
• 167validin.com/blog/zooming_through_bluenoroff_pivots

Related groups 5

What the sources have in common — not a claim that these are the same actor. See the whole graph.

• Lazarus Group G0032
  56 shared indicators · 2 reports cite both · shares ECCENTRICBANDWAGON, HOPLIGHT
• Patchwork G0040
  2 shared indicators
• UNCLASSIFIED
  1 shared indicator
• Sandworm Team G0034
  shares KillDisk
• Transparent Tribe G0134
  shares DarkComet

Timeline 2,115 indicators

Each entry is a batch of indicators that appeared upstream on one date, under the report it was filed with.

Showing the 300 most recent of 2,115. Complete: G0082.json.

No indicator matches. Only the most recent 300 are on this page — the rest are in the JSON.

1. 2026-07-25 320 domain, 2 ipv4, 1 urlthis year

   jumpsec.com/guides/inside-a-dprk-bluenoroff-clickfi…

   domain	02io.us
   domain	02us.sbs
   domain	02usweb.sbs
   domain	02web.sbs
   domain	02web.zoom.02webus.sbs
   domain	02webus.sbs
   domain	02webus.zoom.02us.sbs
   domain	02webus.zoom.web02.sbs
   domain	03app.live
   domain	03app.sbs
   domain	04web.sbs
   domain	05ie.live
   domain	05in.one
   domain	05live.biz
   domain	05live.co
   domain	05live.live
   domain	05live.sbs
   domain	05live.xyz
   domain	05meet.am.in
   domain	05meet.click
   domain	05meet.co
   domain	05meet.live
   domain	05meet.sbs
   domain	05meetus.web05.uk
   domain	05us.live
   domain	05us.sbs
   domain	05us.zoom.05webus.sbs
   domain	05us.zoom.web05.sbs
   domain	05webus.sbs
   domain	06eu.us
   domain	06in.us
   domain	06ln.live
   domain	06on.us
   domain	06us.live
   domain	06us.sbs
   domain	06us.us
   domain	06us.zoom.web06.eu
   domain	06us.zoom.web06.sbs
   domain	06usweb.zoom.us06.sbs
   domain	06web.us06.in
   domain	06web.zoomconnect.io
   domain	06web.zoomlink.studio
   domain	06webin.us
   domain	1ives.co
   domain	adteam.am.in
   domain	ai02n.sbs
   domain	ain01.sbs
   domain	app06zoom.meet06us.net
   domain	apple.cdsventure.xyz
   domain	apps.teamms.live
   domain	biemflow.com
   domain	cdsventure.xyz
   domain	cloud.inteam.live
   domain	desk-live.com
   domain	desk.weventure.capital
   domain	desktop.03app.sbs
   domain	e01i.co
   domain	eu.web03us.sbs
   domain	eu.web06.us
   domain	eu.zoom.04web.sbs
   domain	eu02.us
   domain	eu06.in
   domain	eu06.us
   domain	eu06web.app
   domain	eu07webin.co
   domain	euhub.ue06.us
   domain	global-chat.live
   domain	health.weventure.capital
   domain	hotter.weventure.capital
   domain	i06sn.co
   domain	in06.us
   domain	inteam.live
   domain	iu03e.live
   domain	live-chat.live
   domain	live-com.xyz
   domain	live-meet.app
   domain	live-workplace.com
   domain	live.am.in
   domain	live.desk-live.com
   domain	live.miclesoft.com
   domain	live.micrrosfts.com
   domain	live.micrxsoft.com
   domain	live.teamms-com.xyz
   domain	live.teamsbrowser.com
   domain	live.workplace.teams-com.live
   domain	live02.co
   domain	liveam.video
   domain	livecall.team
   domain	liveconference.eu06.us
   domain	livemicrosft.center
   domain	lives-com.com
   domain	lives.microrrsoft.com
   domain	lives.microsft02.com
   domain	lives.microsoft-desk.com
   domain	lives.ms.teams02.co
   domain	lives.team-global.live
   domain	lives.teamicrosoft.sbs
   domain	lives.teamms.global-chat.live
   domain	lives.teams-app.pro
   domain	lives.teams-desk.live
   domain	lives.teams-workplace.live
   domain	lives.teams02.com
   domain	lives.teams03.com
   domain	lives.teamstunnel.com
   domain	lives02.com
   domain	lives02.run
   domain	lives05.com
   domain	lives06.com
   domain	lives07.com
   domain	livesmicrosft.com
   domain	lzlovewxx.store
   domain	macro.teams.live02.co
   domain	meet.teamicro.live
   domain	meet.zoom.05live.live
   domain	meet06.live
   domain	meet06.us
   domain	meet06us.net
   domain	meetapp.room.ain01.sbs
   domain	meetsdk.online
   domain	miclesoft.com
   domain	micro.com.in
   domain	microcome.com
   domain	microrrsoft.com
   domain	microsft02.com
   domain	microsoft-desk.com
   domain	microsoft-workspace.live
   domain	microsoft.asn.lv
   domain	microsoft.lives02.run
   domain	microsofteam.app
   domain	microsofts.live-workplace.com
   domain	microsorft.live.desk-live.com
   domain	microssoft.live
   domain	microssoft.live-chat.live
   domain	microteam.live
   domain	microvsoft.com
   domain	micrrosfts.com
   domain	micrxsoft.com
   domain	ms.teams02.co
   domain	ms06teams.live-meet.app
   domain	msmeet.in
   domain	msmeet.teamlv.vip
   domain	n04i.one
   domain	net.on05.eu
   domain	on05.eu
   domain	on06.us
   domain	onteam.business.in
   domain	premium.03app.live
   domain	room.ain01.sbs
   domain	room.in06.us
   domain	secure.inteam.live
   domain	syncroom.u06h.lat
   domain	table1.cdsventure.xyz
   domain	team-global.live
   domain	team.asn.lv
   domain	team.micro.com.in
   domain	team.msmeet.in
   domain	team.weblink.contact
   domain	teamapp.live
   domain	teames.lives-com.com
   domain	teamicro.live
   domain	teamicrosoft.sbs
   domain	teamlive.vip
   domain	teamlv.us
   domain	teamlv.vip
   domain	teamms-com.xyz
   domain	teamms.global-chat.live
   domain	teamms.live
   domain	teamms.live-com.xyz
   domain	teamms.live.miclesoft.com
   domain	teamms.microcome.com
   domain	teamms.microssoft.live
   domain	teams-app.liveam.video
   domain	teams-app.pro
   domain	teams-com.live
   domain	teams-desk.live
   domain	teams-workplace.live
   domain	teams.1ives.co
   domain	teams.live.am.in
   domain	teams.live.miclesoft.com
   domain	teams.live02.co
   domain	teams.lives02.com
   domain	teams.microsoft.lives02.run
   domain	teams.microsofts.live-workplace.com
   domain	teams.web.lives06.com
   domain	teams02.co
   domain	teams02.com
   domain	teams02.lives05.com
   domain	teams03.com
   domain	teams05web.lives07.com
   domain	teams07.lives07.com
   domain	teams07.web07microsoft.live
   domain	teams08.run
   domain	teamsbrowser.com
   domain	teamstunnel.com
   domain	u06h.lat
   domain	u07ei.biz
   domain	ue05.us
   domain	ue06.us
   domain	uk06.zoom.eu06web.app
   domain	us-05.in
   domain	us.meet06.live
   domain	us.web.06zoom.us
   domain	us.zoom.02usweb.sbs
   domain	us.zoom.06web.us
   domain	us.zoom.06webin.us
   domain	us01webinar.zoom.e01i.co
   domain	us02.sbs
   domain	us02.zoomin.web02eu.live
   domain	us04meet.web04.sbs
   domain	us04web.zoom04web.run
   domain	us05.eu
   domain	us05.zoom.web05.uk
   domain	us06.in
   domain	us06.sbs
   domain	us06web.zoom.06us.sbs
   domain	usewebin.room.in06.us
   domain	usezoom.net.on05.eu
   domain	usezoom.webin.n04i.one
   domain	usezoomin.06in.us
   domain	ushub.syncroom.u06h.lat
   domain	usinroomweeb.i06sn.co
   domain	usweb.eu02.us
   domain	usweb.zoom.02io.us
   domain	usweb.zoom.05meet.sbs
   domain	usweb.zoom.05us.live
   domain	usweb.zoom.05us.sbs
   domain	usweb.zoom.06ln.live
   domain	usweb.zoom.06us.live
   domain	usweb.zoom.us02.sbs
   domain	usweb06.zoom.meet06.us
   domain	uswebr.zoomin.on06.us
   domain	uszoom.web.05live.sbs
   domain	uszoom.web.eu06.in
   domain	uszoomhub.iu03e.live
   domain	uszoomsweb.ue05.us
   domain	vcallsdk.online
   domain	web-teams.microvsoft.com
   domain	web.05ie.live
   domain	web.05live.sbs
   domain	web.05live.xyz
   domain	web.06us.us
   domain	web.06zoom.us
   domain	web.eu06.in
   domain	web.lives06.com
   domain	web.zoomapp.05meet.am.in
   domain	web.zoomapp.05meet.live
   domain	web02.sbs
   domain	web02us.zoom.02io.us
   domain	web03us.sbs
   domain	web04.sbs
   domain	web05.sbs
   domain	web05.uk
   domain	web05.zoom.us-05.in
   domain	web06.eu
   domain	web06.sbs
   domain	web07microsoft.live
   domain	web08.teams08.run
   domain	webapp.zoom.05live.co
   domain	webin.n04i.one
   domain	webinaroom.05in.one
   domain	webine.zoom.eu07webin.co
   domain	weblink.contact
   domain	webmeet.zoom.05live.biz
   domain	webus.zoom.02web.sbs
   domain	webus.zoom.05live.us
   domain	webus.zoom.05meet.co
   domain	workflowin.sbs
   domain	workplace.teams-com.live
   domain	zmtest.weventure.capital
   domain	zoom.02io.us
   domain	zoom.02us.sbs
   domain	zoom.02usweb.sbs
   domain	zoom.02web.sbs
   domain	zoom.02webus.sbs
   domain	zoom.05live.biz
   domain	zoom.05live.co
   domain	zoom.05live.live
   domain	zoom.05live.us
   domain	zoom.05meet.click
   domain	zoom.05meet.co
   domain	zoom.05meet.sbs
   domain	zoom.05us.live
   domain	zoom.05us.sbs
   domain	zoom.05webus.sbs
   domain	zoom.06ln.live
   domain	zoom.06us.live
   domain	zoom.06us.sbs
   domain	zoom.06web.us
   domain	zoom.06web.us06.in
   domain	zoom.06webin.us
   domain	zoom.desktop.03app.sbs
   domain	zoom.e01i.co
   domain	zoom.eu07webin.co
   domain	zoom.meet06.us
   domain	zoom.premium.03app.live
   domain	zoom.us-05.in
   domain	zoom.us.meet06.live
   domain	zoom.us02.sbs
   domain	zoom.us06.sbs
   domain	zoom.web.06us.us

   copy batch · 23 more in this batch, in the JSON

Further reading 184

• attack.mitre.org/groups/G0082
• go.crowdstrike.com/rs/281-OBQ-266/images/Report2021GTR.pdf
• learn.microsoft.com/en-us/microsoft-365/security/intelligen…
• securelist.com/lazarus-under-the-hood/77908
• services.google.com/fh/files/misc/apt38-un-usual-suspects.p…
• us-cert.cisa.gov/ncas/alerts/aa20-239a
• crowdstrike.com/blog/meet-crowdstrikes-adversary-of-the…
• justice.gov/opa/pr/three-north-korean-military-hack…
• secureworks.com/research/threat-profiles/nickel-gladsto…
• otx.alienvault.com/pulse/5bb4bdccd63eeb0a87994870
• x.com/IstaPee/status/1935788234468213130
• x.com/birchb0y/status/1935436678602055682
• virustotal.com/gui/file/8949207761f3d09734aa716da1e6c1…
• virustotal.com/gui/file/66916b0dfd9956b4b74640a4feb945…
• any.run/cybersecurity-blog/lazarus-macos-malwar…
• stepsecurity.io/blog/axios-compromised-on-npm-malicious…
• content.fireeye.com/apt/rpt-apt38
• virustotal.com/gui/ip-address/172.86.121.198/relations
• app.any.run/tasks/8d5e66c9-3942-4e00-bfdf-8f2c24054…
• twitter.com/C0ryInTheHous3/status/16610754367832596…
• virustotal.com/gui/file/864f2a624a58cf460689d805e271fb…
• virustotal.com/gui/ip-address/216.107.136.11/relations
• validin.com/blog/zooming_through_bluenoroff_pivots
• virustotal.com/gui/file/3b6f30369a4ee8bf9409d141b6d1b3…
• virustotal.com/gui/ip-address/172.93.193.219/relations
• community.emergingthreats.net/t/ruleset-update-summary-2023-08-10-v10…
• virustotal.com/gui/ip-address/45.61.157.78/relations
• x.com/_SEAL_Org/status/2041673724764569896
• x.com/moonlock_lab/status/2015857322963173657
• x.com/Cyberteam008/status/2040979630480638398
• x.com/cyberoverdrive/status/18796169420401256…
• research.jfrog.com/post/easy-day-js
• microsoft.com/en-us/security/blog/2026/06/17/postinst…
• x.com/Cyberteam008/status/1826585708376850744
• virustotal.com/gui/ip-address/142.11.206.73/relations
• virustotal.com/gui/file/2c0a66c6370b4aa88ab3805d520e86…
• virustotal.com/gui/ip-address/188.227.196.252/relations
• otx.alienvault.com/pulse/5f74bcb0be4abfe12d93d2bf
• x.com/_SEAL_Org/status/2041289021503005128
• virustotal.com/gui/file/d235741256f05ad8ceb44c469f4471…

144 more, and the report behind every indicator, in G0082.json.