# Andariel

> As of 2026-09-30, Andariel is a North Korea-nexus threat actor tracked by Threadlinqs Intelligence across 25 threats spanning apt, supply chain, zero day. Also known as Onyx Sleet, PLUTONIUM, Silent Chollima, Stonefly. ATT&CK coverage spans 205 techniques across 15 tactics in 25 of 25 tracked threats. Most-observed techniques: T1041 (Exfiltration Over C2 Channel), T1005 (Data from Local System), T1082 (System Information Discovery).

- **Nation:** North Korea
- **Tracked threats:** 25
- **Categories:** APT, SUPPLY_CHAIN, ZERO_DAY, VULNERABILITY, MALWARE, RANSOMWARE, PHISHING
- **Also known as:** Onyx Sleet, PLUTONIUM, Silent Chollima, Stonefly, Lazarus subgroup
- **As of:** 2026-09-30

## ATT&CK techniques observed

205 techniques observed across 25 of 25 tracked threats. Tactics: Stealth (formerly Defense Evasion) (43), Command and Control (20), Credential Access (19), Execution (18), Discovery (16), Resource Development (16).

- [T1041](https://intel.threadlinqs.com/technique/T1041) Exfiltration Over C2 Channel — Exfiltration — observed in 19 of 25 tracked threats
- [T1005](https://intel.threadlinqs.com/technique/T1005) Data from Local System — Collection — observed in 18 of 25 tracked threats
- [T1082](https://intel.threadlinqs.com/technique/T1082) System Information Discovery — Discovery — observed in 18 of 25 tracked threats
- [T1105](https://intel.threadlinqs.com/technique/T1105) Ingress Tool Transfer — Command and Control — observed in 18 of 25 tracked threats
- [T1027](https://intel.threadlinqs.com/technique/T1027) Obfuscated Files or Information — Stealth (formerly Defense Evasion) — observed in 16 of 25 tracked threats
- [T1140](https://intel.threadlinqs.com/technique/T1140) Deobfuscate/Decode Files or Information — Stealth (formerly Defense Evasion) — observed in 14 of 25 tracked threats
- [T1071.001](https://intel.threadlinqs.com/technique/T1071.001) Web Protocols — Command and Control — observed in 13 of 25 tracked threats
- [T1036](https://intel.threadlinqs.com/technique/T1036) Masquerading — Stealth (formerly Defense Evasion) — observed in 11 of 25 tracked threats
- [T1059](https://intel.threadlinqs.com/technique/T1059) Command and Scripting Interpreter — Execution — observed in 11 of 25 tracked threats
- [T1071](https://intel.threadlinqs.com/technique/T1071) Application Layer Protocol — Command and Control — observed in 11 of 25 tracked threats
- [T1083](https://intel.threadlinqs.com/technique/T1083) File and Directory Discovery — Discovery — observed in 11 of 25 tracked threats
- [T1657](https://intel.threadlinqs.com/technique/T1657) Financial Theft — Impact — observed in 11 of 25 tracked threats
- [T1204](https://intel.threadlinqs.com/technique/T1204) User Execution — Execution — observed in 10 of 25 tracked threats
- [T1113](https://intel.threadlinqs.com/technique/T1113) Screen Capture — Collection — observed in 9 of 25 tracked threats
- [T1555](https://intel.threadlinqs.com/technique/T1555) Credentials from Password Stores — Credential Access — observed in 9 of 25 tracked threats

## Tracked threats

- [Bitget Exchange Loses ~$351.6M (On-Chain: ~$356.9M) in Suspected North Korean (TraderTraitor) Backend Compromise and Authorization-Flow Abuse](https://intel.threadlinqs.com/threat/TL-2026-2650) — CRITICAL
- [DPRK-Linked Graphalgo Campaign Abuses HashiCorp Terraform Registry with Malicious Providers and Go Modules to Deliver Go RAT with Slack and Arbitrum Sepolia Blockchain C2](https://intel.threadlinqs.com/threat/TL-2026-2635) — HIGH
- [Lazarus Exploits CVE-2026-68820 Zero-Day via Malicious PDF Viewer in Operation Dream Job Against Defense Industry](https://intel.threadlinqs.com/threat/TL-2026-2561) — CRITICAL
- [Microsoft August 2026 Patch Tuesday: 400 Flaws Fixed, Including Lazarus-Exploited Zero-Day CVE-2026-68820 (AFD.sys) and Two Publicly Disclosed Zero-Days (CVE-2026-62832 "LegacyHive", CVE-2026-72971)](https://intel.threadlinqs.com/threat/TL-2026-1987) — CRITICAL
- [Larva-26005 APT Campaign: Xctdoor and CRAT Backdoors Targeting South Korea (2020–2026)](https://intel.threadlinqs.com/threat/TL-2026-1908) — CRITICAL
- [North Korea's Lazarus Group Linked to Tool-Sharing with Gunra Ransomware Operators Against South Korean Targets ("Operation Double Barrel")](https://intel.threadlinqs.com/threat/TL-2026-1797) — HIGH
- [State-Sponsored Actors Exploit AnySign4PC Zero-Day via Compromised Watering-Hole Sites to Deploy SIGNBT and COPPERHEDGE Backdoors](https://intel.threadlinqs.com/threat/TL-2026-1780) — CRITICAL
- [NSFOCUS 2025 APT Group Research Annual Report: 662 Active APT Groups, 42 Newly Disclosed, AI-Weaponized Attacks Surge 89% YoY](https://intel.threadlinqs.com/threat/TL-2026-1559) — MEDIUM
- [PolinRider DPRK npm Supply-Chain Loader Uses Blockchain Dead Drops for C2 (BeaverTail/InvisibleFerret)](https://intel.threadlinqs.com/threat/TL-2026-1215) — HIGH
- [Lazarus-Linked npm Malware Masquerades as Rollup Polyfills (rollup-packages-polyfill-core, rollup-runtime-polyfill-core, swift-parse-stream, quirky-token, rollup-plugin-polyfill-connect, react-icon-svgs)](https://intel.threadlinqs.com/threat/TL-2026-1030) — HIGH
- [ClickFix Campaigns Evolve API-Driven Payload Delivery: Analysis of 3,000 Live Payloads Reveals New Evasion Techniques](https://intel.threadlinqs.com/threat/TL-2026-1027) — HIGH
- [Xctdoor Backdoor Delivered via Resume-Themed LNK Files, PowerShell/VBScript Loaders, and ProximityUxHost.exe DLL Side-Loading (Andariel)](https://intel.threadlinqs.com/threat/TL-2026-0869) — HIGH
- [Lazarus Group npm Brandjacking Campaign — buffer-utilities Multi-Stage Staging Framework (sonatype-2026-003558)](https://intel.threadlinqs.com/threat/TL-2026-0726) — HIGH
- [RemotePE: In-Memory Lazarus RAT Delivered via DPAPILoader and RemotePELoader Multi-Stage Chain](https://intel.threadlinqs.com/threat/TL-2026-0722) — HIGH
- [Lazarus RemotePE Memory-Only RAT — DPAPILoader + RemotePELoader Chain Targeting Financial & Cryptocurrency Firms](https://intel.threadlinqs.com/threat/TL-2026-0579) — HIGH
- [Lazarus Group (DPRK) Hides BeaverTail / InvisibleFerret Loader in Git Hooks via precommit.vercel.app — Contagious Interview / TaskJacker Evolution (May 2026)](https://intel.threadlinqs.com/threat/TL-2026-0464) — HIGH
- [KelpDAO LayerZero Bridge Exploit — $292M rsETH Minted Against Non-Existent Burn (Lazarus Group, April 2026)](https://intel.threadlinqs.com/threat/TL-2026-0416) — CRITICAL
- [Apache ActiveMQ OpenWire Deserialization RCE (CVE-2023-46604) — 6,400 Brokers Actively Exploited by HelloKitty, Kinsing, TellYouThePass and Andariel (Lazarus)](https://intel.threadlinqs.com/threat/TL-2026-0404) — CRITICAL
- [DPRK Contagious Interview Supply Chain RAT Campaign via npm, PyPI, and Multi-Ecosystem Package Poisoning](https://intel.threadlinqs.com/threat/TL-2026-0332) — HIGH
- [Supply Chain Attacks on Crypto Ecosystem via Developer Toolchain Compromise](https://intel.threadlinqs.com/threat/TL-2026-0248) — HIGH
- [Lazarus Group (Stonefly) Medusa Ransomware — DPRK State-Backed Actors Deploy Medusa RaaS Targeting U.S. Healthcare](https://intel.threadlinqs.com/threat/TL-2026-0172) — CRITICAL
- [Contagious Interview IDE Task Hijacking — North Korean BeaverTail/PyLangGhost/GolangGhost via VS Code & Cursor Tasks, GitHub Gist Staging, Developer Targeting](https://intel.threadlinqs.com/threat/TL-2026-0148) — HIGH
- [Lazarus Group Medusa Ransomware — North Korean State-Backed Extortion Targeting US Healthcare and Middle East](https://intel.threadlinqs.com/threat/TL-2026-0140) — CRITICAL
- [Matryoshka ClickFix macOS Variant — Nested Heredoc Obfuscation, AppleScript Credential Stealer, Trezor Suite Replacement, Ledger Live Surgical Patching, API-Gated C2](https://intel.threadlinqs.com/threat/TL-2026-0120) — HIGH
- [LABYRINTH CHOLLIMA Evolves into Three DPRK Adversaries](https://intel.threadlinqs.com/threat/TL-2026-0063) — CRITICAL

## Related CVEs

40 of 63 CVEs referenced by tracked Andariel activity.

- [CVE-2026-72971](https://intel.threadlinqs.com/cve/CVE-2026-72971)
- [CVE-2026-70332](https://intel.threadlinqs.com/cve/CVE-2026-70332)
- [CVE-2026-70130](https://intel.threadlinqs.com/cve/CVE-2026-70130)
- [CVE-2026-68823](https://intel.threadlinqs.com/cve/CVE-2026-68823)
- [CVE-2026-68820](https://intel.threadlinqs.com/cve/CVE-2026-68820)
- [CVE-2026-68816](https://intel.threadlinqs.com/cve/CVE-2026-68816)
- [CVE-2026-68804](https://intel.threadlinqs.com/cve/CVE-2026-68804)
- [CVE-2026-68794](https://intel.threadlinqs.com/cve/CVE-2026-68794)
- [CVE-2026-65813](https://intel.threadlinqs.com/cve/CVE-2026-65813)
- [CVE-2026-65789](https://intel.threadlinqs.com/cve/CVE-2026-65789)
- [CVE-2026-65665](https://intel.threadlinqs.com/cve/CVE-2026-65665)
- [CVE-2026-65657](https://intel.threadlinqs.com/cve/CVE-2026-65657)
- [CVE-2026-64921](https://intel.threadlinqs.com/cve/CVE-2026-64921)
- [CVE-2026-64911](https://intel.threadlinqs.com/cve/CVE-2026-64911)
- [CVE-2026-64910](https://intel.threadlinqs.com/cve/CVE-2026-64910)
- [CVE-2026-64909](https://intel.threadlinqs.com/cve/CVE-2026-64909)
- [CVE-2026-64907](https://intel.threadlinqs.com/cve/CVE-2026-64907)
- [CVE-2026-64903](https://intel.threadlinqs.com/cve/CVE-2026-64903)
- [CVE-2026-64898](https://intel.threadlinqs.com/cve/CVE-2026-64898)
- [CVE-2026-63532](https://intel.threadlinqs.com/cve/CVE-2026-63532)
- [CVE-2026-63526](https://intel.threadlinqs.com/cve/CVE-2026-63526)
- [CVE-2026-63525](https://intel.threadlinqs.com/cve/CVE-2026-63525)
- [CVE-2026-63520](https://intel.threadlinqs.com/cve/CVE-2026-63520)
- [CVE-2026-63518](https://intel.threadlinqs.com/cve/CVE-2026-63518)
- [CVE-2026-63515](https://intel.threadlinqs.com/cve/CVE-2026-63515)
- [CVE-2026-62915](https://intel.threadlinqs.com/cve/CVE-2026-62915)
- [CVE-2026-62914](https://intel.threadlinqs.com/cve/CVE-2026-62914)
- [CVE-2026-62913](https://intel.threadlinqs.com/cve/CVE-2026-62913)
- [CVE-2026-62912](https://intel.threadlinqs.com/cve/CVE-2026-62912)
- [CVE-2026-62911](https://intel.threadlinqs.com/cve/CVE-2026-62911)
- [CVE-2026-62910](https://intel.threadlinqs.com/cve/CVE-2026-62910)
- [CVE-2026-62893](https://intel.threadlinqs.com/cve/CVE-2026-62893)
- [CVE-2026-62890](https://intel.threadlinqs.com/cve/CVE-2026-62890)
- [CVE-2026-62889](https://intel.threadlinqs.com/cve/CVE-2026-62889)
- [CVE-2026-62878](https://intel.threadlinqs.com/cve/CVE-2026-62878)
- [CVE-2026-62869](https://intel.threadlinqs.com/cve/CVE-2026-62869)
- [CVE-2026-62832](https://intel.threadlinqs.com/cve/CVE-2026-62832)
- [CVE-2026-62827](https://intel.threadlinqs.com/cve/CVE-2026-62827)
- [CVE-2026-62824](https://intel.threadlinqs.com/cve/CVE-2026-62824)
- [CVE-2026-62823](https://intel.threadlinqs.com/cve/CVE-2026-62823)

## Full data

Infrastructure, IOC values and detection queries (Splunk SPL / Microsoft KQL / Sigma) require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/actor/Andariel