APT Explorer

All actors

AppleJeus

Also reported as UNC4736, Jade Sleet, UNC2970, UNC4899, TraderTraitor and 28 other names. Linked to North Korea by four sources.

Reports
70
Last reported
Known CVEs
54
Techniques in ATT&CK
2
Origin
North Korea
ID
G1049
Sources
ATT&CKMISPETDAMalpediaMicrosoft
Merge evidence
14 alias matches

Reports per quarter

Dated reports, 2019 Q1 to 2026 Q3.

Techniques seen in the last two years

Show all 258 techniques Show fewer

Counts come from technique IDs in the actor's report text. “Reports only” means reports name the technique but MITRE ATT&CK® does not list it for this actor.

CVEs named in reports

Show all 54 CVEs Show fewer

KEV marks a CVE in CISA's Known Exploited Vulnerabilities Catalog, and “ransomware” marks one that the catalog records as used in ransomware campaigns.

Reports

  1. Don’t Call Us, We’ll Call Your APIs | TraderTraitor Backdoors Resurface on Victim With No Crypto Ties

    Malpedia library date ORKL

    Archived copy on ORKL Details

  2. Beyond Lazarus: Organization of DPRK cyber capabilities

    Malpedia library date ORKL

    Archived copy on ORKL Details

  3. Beyond Lazarus: Organization of DPRK Cyber Capabilities

    Malpedia library date ORKL

    Archived copy on ORKL Details

  4. Shattering the Dream - When a Job Offer Becomes a Zero-Day Attack

    Malpedia library date ORKL

    Archived copy on ORKL Details

  5. Don't Fear the Repo: UNK_DeadDrop Phishing Campaign Targets Developers to Steal Cryptocurrency | Proofpoint US

    Malpedia library date ORKL

    Archived copy on ORKL Details

  6. Bankshot (Malware Family)

    date ORKL added it ORKL

    The title opens a link whose publisher is not confirmed. Archived copy on ORKL Details

  7. Inside Lazarus: How North Korea uses AI to industrialize attacks on developers

    Malpedia library date ORKL

    Archived copy on ORKL Details

  8. TraderTraitor: North Korean State-Sponsored APT Targets Blockchain Companies | CISA

    date ORKL added it ORKL

    Archived copy on ORKL Details

  9. North Koreans finish initial laundering stage after more than $1 billion stolen from Bybit

    date ORKL added it ORKL

    Archived copy on ORKL Details

  10. FBI Identifies Lazarus Group Cyber Actors as Responsible for Theft of $41 Million from Stake.com | Federal Bureau of Investigation

    date ORKL added it ORKL

    Archived copy on ORKL Details

Show all 70 reports Show fewer

  1. Assessed Cyber Structure and Alignments of North Korea in 2023 | Mandiant

    date ORKL added it ORKL

    Archived copy on ORKL Details

  2. FastCash (Malware Family)

    date ORKL added it ORKL

    The title opens a link whose publisher is not confirmed. Archived copy on ORKL Details

  3. FBI links North Korean hackers to $308 million crypto heist

    date ORKL added it ORKL

    Archived copy on ORKL Details

  4. Security Update Tuesday 11 April 2023 - Interim Assessment Concluded

    date ORKL added it ORKL

    Archived copy on ORKL Details

  5. 3CX Software Supply Chain Compromise Initiated by a Prior Software Supply Chain Compromise; Suspected North Korean Actor Responsible | Mandiant

    date ORKL added it ORKL

    Archived copy on ORKL Details

  6. DEV-0139 launches targeted attacks against the cryptocurrency industry | Microsoft Security Blog

    date ORKL added it ORKL

    Archived copy on ORKL Details

  7. A New North Korean Group Emerges, Disrupting the Open-Source Ecosystem

    date ORKL added it ORKL

    Archived copy on ORKL Details

  8. Gleaming Pisces Poisoned Python Packages Campaign Delivers PondRAT Linux and macOS Backdoors

    date ORKL added it ORKL

    Archived copy on ORKL Details

  9. Radiant links $50 million crypto heist to North Korean hackers

    date ORKL added it ORKL

    Archived copy on ORKL Details

  10. Threat Assessment: North Korean Threat Groups

    date ORKL added it ORKL

    Archived copy on ORKL Details

  11. An Offer You Can Refuse: UNC2970 Backdoor Deployment Using Trojanized PDF Reader

    date ORKL added it ORKL

    Archived copy on ORKL Details

  12. Lazarus Group, Hidden Cobra, Labyrinth Chollima

    date ORKL added it ORKL

    The title opens a link whose publisher is not confirmed. Archived copy on ORKL Details

  13. Cloud Threat Horizons Report H1 2026

    Malpedia library date ORKL

    Archived copy on ORKL Details

  14. Threats to the Defense Industrial Base

    Malpedia library date ORKL

    Archived copy on ORKL Details

  15. A Pain in the Mist

    Malpedia library date ORKL

    Archived copy on ORKL Details

  16. GTIG AI Threat Tracker: Advances in Threat Actor Usage of AI Tools

    Malpedia library date ORKL

    Archived copy on ORKL Details

  17. advances-in-threat-actor-usage-of-ai-tools-en.pdf

    file creation date ORKL

    Archived copy on ORKL Details

  18. Gotta fly: Lazarus targets the UAV sector

    Malpedia library date ORKL

    Archived copy on ORKL Details

  19. TraderTraitor: Deep Dive

    Malpedia library date ORKL

    Archived copy on ORKL Details

  20. DTEX-Exposing+DPRK+Cyber+Syndicate+and+Hidden+IT+Workforce.pdf

    Malpedia library date ORKL

    Archived copy on ORKL Details

  21. ESET APT Activity Report Q4 2024-Q1 2025

    Malpedia library date ORKL

    Archived copy on ORKL Details

  22. m-trends-2025-en.pdf

    Malpedia library date ORKL

    Archived copy on ORKL Details

  23. Slow Pisces Targets Developers With Coding Challenges and Introduces New Customized Python Malware

    Malpedia library date ORKL

    Archived copy on ORKL Details

  24. Tempted to Classifying APT Actors: Practical Challenges of Attribution in the Case of Lazarus’s Subgroup - JPCERT/CC Eyes

    Malpedia library date ORKL

    Archived copy on ORKL Details

  25. Lazarus group evolves its infection chain with old and new malware

    Malpedia library date ORKL

    Archived copy on ORKL Details

  26. ESET APT Activity Report Q2 2024-Q3 2024

    Malpedia library date ORKL

    Archived copy on ORKL Details

  27. Evolution of Lazarus ‘FudModule - no longer (stand)alone’

    Malpedia library date ORKL

    Archived copy on ORKL Details

  28. An Offer You Can Refuse: UNC2970 Backdoor Deployment Using Trojanized PDF Reader

    Malpedia library date ORKL

    Archived copy on ORKL Details

  29. North Korean threat actor Citrine Sleet exploiting Chromium zero-day | Microsoft Security Blog

    Malpedia library date ORKL

    Archived copy on ORKL Details

  30. Threat Actor Groups Tracked by Palo Alto Networks Unit 42 (Updated Aug. 1, 2025)

    Malpedia library date ORKL

    Archived copy on ORKL Details

  31. Insights on Cyber Threats Targeting Users and Enterprises in Brazil

    Malpedia library date ORKL

    Archived copy on ORKL Details

  32. m-trends-2024.pdf

    Malpedia library date ORKL

    Archived copy on ORKL Details

  33. Microsoft Security Compliance and Identity

    Malpedia library date ORKL

    Archived copy on ORKL Details

  34. Crypto Country: North Korea's Targeting of Cryptocurrency

    file creation date ORKL

    Archived copy on ORKL Details

  35. Assessed Cyber Structure and Alignments of North Korea in 2023 | Mandiant

    Malpedia library date ORKL

    Archived copy on ORKL Details

  36. Lazarus campaigns and backdoors in 2022-23

    Malpedia library date ORKL

    Archived copy on ORKL Details

  37. North Korea Leverages SaaS Provider in a Targeted Supply Chain Attack | Mandiant

    Malpedia library date ORKL

    Archived copy on ORKL Details

  38. Security alert: social engineering campaign targets technology industry employees

    Malpedia library date ORKL

    Archived copy on ORKL Details

  39. 3CX Software Supply Chain Compromise Initiated by a Prior Software Supply Chain Compromise; Suspected North Korean Actor Responsible

    date in the title ORKL

    The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Details

  40. Security Update Thursday 20 April 2023 – Initial Intrusion Vector Found

    date in the title ORKL

    The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Details

  41. 3CX Software Supply Chain Compromise Initiated by a Prior Software Supply Chain Compromise; Suspected North Korean Actor Responsible | Mandiant

    Malpedia library date ORKL

    Archived copy on ORKL Details

  42. Security Update Thursday 20 April 2023 – Initial Intrusion Vector Found

    Malpedia library date ORKL

    Archived copy on ORKL Details

  43. APT attacks on industrial organizations in H2 2022 | Kaspersky ICS CERT EN

    Malpedia library date Kaspersky ORKLCCS '25 data

    Archived copy on ORKL Details

  44. Stealing the LIGHTSHOW (Part One) - North Korea's UNC2970

    file creation date Mandiant ORKL

    The link to Mirror on Box failed its last check. Mirror on Box Details

  45. Stealing the LIGHTSHOW (Part Two) — LIGHTSHIFT and LIGHTSHOW | Mandiant

    Malpedia library date ORKL

    Archived copy on ORKL Details

  46. Stealing the LIGHTSHOW (Part One) — North Korea's UNC2970 | Mandiant

    Malpedia library date ORKL

    Archived copy on ORKL Details

  47. Stealing the LIGHTSHOW (Part Two) - LIGHTSHIFT and LIGHTSHOW

    date in the CCS '25 data Mandiant ORKLCCS '25 data

    The link to Mirror on Box failed its last check. Mirror on Box Details

  48. Stealing the LIGHTSHOW (Part One) — North Korea's UNC2970

    date in the title ORKL

    The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Details

  49. Stealing the LIGHTSHOW (Part Two) — LIGHTSHIFT and LIGHTSHOW

    date in the title ORKL

    The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Details

  50. The DPRK delicate sound of cyber

    Malpedia library date ORKL

    Archived copy on ORKL Details

  51. The DPRK delicate sound of cyber

    date in the title ORKL

    The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Details

  52. It's Time to PuTTY! DPRK Job Opportunity Phishing via WhatsApp

    date in the title ORKL

    The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Details

  53. DPRK Job Opportunity Phishing via WhatsApp | PuTTY Utility

    Malpedia library date ORKL

    Archived copy on ORKL Details

  54. TraderTraitor: North Korean State-Sponsored APT Targets Blockchain Companies | CISA

    Malpedia library date ORKL

    Archived copy on ORKL Details

  55. TraderTraitor: North Korean State-Sponsored APT Targets Blockchain Companies

    Malpedia library date CISA ORKL

    The link to Mirror on Box failed its last check. Mirror on Box Details

  56. TraderTraitor: North Korean State-Sponsored APT Targets Blockchain Companies | CISA

    Malpedia library date ORKL

    Archived copy on ORKL Details

  57. Alert (AA22-108A)- TraderTraitor- North Korean State-Sponsored APT Targets Blockchain Companies

    date in the title ORKL

    The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Details

  58. AA22-108A TraderTraitor North Korean State-Sponsored APT Targets Blockchain Companies (PDF)

    date in the CCS '25 data CISA CCS '25 data

    Details

  59. SectorA01 Custom Proxy Utility Tool Analysis

    date in the title ORKL

    The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Details

  60. SectorA01 Custom Proxy Utility Tool Analysis – Red Alert

    Malpedia library date ORKL

    Archived copy on ORKL Details

Newest first. Details opens the report in Explore.