Threadlinqs IntelligenceStart free

Threat actorNorth Korea / ChinaTracked since 2026-03

Slow Pisces

Also known as:Adept LibraAltered SpiderLazarusTraderTraitorJade SleetHIDDEN COBRADiamond SleetNICKEL ACADEMYLabyrinth ChollimaPCPcatShellForceDeadCatx3

As of 2026-05-30, Slow Pisces is a North Korea / China-nexus threat actor tracked by Threadlinqs Intelligence across 2 threats spanning vulnerability, apt. Also known as Adept Libra, Altered Spider, Lazarus, TraderTraitor. ATT&CK coverage spans 32 techniques across 14 tactics in 2 of 2 tracked threats. Most-observed techniques: T1059 (Command and Scripting Interpreter), T1078 (Valid Accounts), T1528 (Steal Application Access Token).

Tracked threats
22 critical
First seen
2026-03-09
Last seen
2026-04-06
ATT&CK techniques
32across 2 of 2 threats
Related CVEs
1Referenced by its activity
Attribution
North Korea / ChinaNation or origin
Nation: North Korea / China · 2 tracked threat(s) · Categories: VULNERABILITY, APT

Activity timeline

Slow Pisces appears in 2 tracked threats between and ; the busiest month was 2026-03 with 1 report.

ATT&CK techniques observed

32 techniques observed across 2 of 2 tracked threats · Discovery (4), Execution (4), Command and Control (3), Impact (3), Initial Access (3), Persistence (3)
  • T1059 Command and Scripting Interpreter — Executionobserved in 2 of 2 tracked threats
  • T1078 Valid Accounts — Initial Accessobserved in 2 of 2 tracked threats
  • T1528 Steal Application Access Token — Credential Accessobserved in 2 of 2 tracked threats
  • T1530 Data from Cloud Storage — Collectionobserved in 2 of 2 tracked threats
  • T1550 Use Alternate Authentication Material — Lateral Movementobserved in 2 of 2 tracked threats
  • T1552 Unsecured Credentials — Credential Accessobserved in 2 of 2 tracked threats
  • T1573 Encrypted Channel — Command and Controlobserved in 2 of 2 tracked threats
  • T1611 Escape to Host — Privilege Escalationobserved in 2 of 2 tracked threats
  • T1613 Container and Resource Discovery — Discoveryobserved in 2 of 2 tracked threats
  • T1021 Remote Services — Lateral Movementobserved in 1 of 2 tracked threats
  • T1036 Masquerading — Stealth (formerly Defense Evasion)observed in 1 of 2 tracked threats
  • T1041 Exfiltration Over C2 Channel — Exfiltrationobserved in 1 of 2 tracked threats
  • T1046 Network Service Discovery — Discoveryobserved in 1 of 2 tracked threats
  • T1053 Scheduled Task/Job — Persistenceobserved in 1 of 2 tracked threats
  • T1071 Application Layer Protocol — Command and Controlobserved in 1 of 2 tracked threats

Tracked threats

Related CVEs

1 CVE referenced by tracked Slow Pisces activity