# TA444

> As of 2026-10-31, TA444 is a North Korea-nexus threat actor tracked by Threadlinqs Intelligence across 5 threats spanning malware, supply chain. Also known as APT38, BlueNoroff, APT38 - G0082. ATT&CK coverage spans 53 techniques across 14 tactics in 5 of 5 tracked threats. Most-observed techniques: T1005 (Data from Local System), T1027 (Obfuscated Files or Information), T1041 (Exfiltration Over C2 Channel).

- **Nation:** North Korea
- **Tracked threats:** 5
- **Categories:** MALWARE, SUPPLY_CHAIN
- **Also known as:** APT38, BlueNoroff, APT38 - G0082
- **As of:** 2026-10-31

## ATT&CK techniques observed

53 techniques observed across 5 of 5 tracked threats. Tactics: Stealth (formerly Defense Evasion) (10), Command and Control (7), Discovery (6), Resource Development (6), Collection (5), Execution (4).

- [T1005](https://intel.threadlinqs.com/technique/T1005) Data from Local System — Collection — observed in 5 of 5 tracked threats
- [T1027](https://intel.threadlinqs.com/technique/T1027) Obfuscated Files or Information — Stealth (formerly Defense Evasion) — observed in 5 of 5 tracked threats
- [T1041](https://intel.threadlinqs.com/technique/T1041) Exfiltration Over C2 Channel — Exfiltration — observed in 4 of 5 tracked threats
- [T1059](https://intel.threadlinqs.com/technique/T1059) Command and Scripting Interpreter — Execution — observed in 4 of 5 tracked threats
- [T1071](https://intel.threadlinqs.com/technique/T1071) Application Layer Protocol — Command and Control — observed in 4 of 5 tracked threats
- [T1082](https://intel.threadlinqs.com/technique/T1082) System Information Discovery — Discovery — observed in 4 of 5 tracked threats
- [T1105](https://intel.threadlinqs.com/technique/T1105) Ingress Tool Transfer — Command and Control — observed in 4 of 5 tracked threats
- [T1057](https://intel.threadlinqs.com/technique/T1057) Process Discovery — Discovery — observed in 3 of 5 tracked threats
- [T1070](https://intel.threadlinqs.com/technique/T1070) Indicator Removal — Stealth (formerly Defense Evasion) — observed in 3 of 5 tracked threats
- [T1195](https://intel.threadlinqs.com/technique/T1195) Supply Chain Compromise — Initial Access — observed in 3 of 5 tracked threats
- [T1204](https://intel.threadlinqs.com/technique/T1204) User Execution — Execution — observed in 3 of 5 tracked threats
- [T1547](https://intel.threadlinqs.com/technique/T1547) Boot or Logon Autostart Execution — Persistence — observed in 3 of 5 tracked threats
- [T1555](https://intel.threadlinqs.com/technique/T1555) Credentials from Password Stores — Credential Access — observed in 3 of 5 tracked threats
- [T1585](https://intel.threadlinqs.com/technique/T1585) Establish Accounts — Resource Development — observed in 3 of 5 tracked threats
- [T1036](https://intel.threadlinqs.com/technique/T1036) Masquerading — Stealth (formerly Defense Evasion) — observed in 2 of 5 tracked threats

## Tracked threats

- [DPRK SpectralBlur macOS Backdoor (TA444 / BlueNoroff)](https://intel.threadlinqs.com/threat/TL-2026-4894) — HIGH
- [Mastra npm Supply-Chain Compromise (@mastra/* namespace) via Typosquatted 'easy-day-js' — Multi-Stage Cross-Platform Infostealer](https://intel.threadlinqs.com/threat/TL-2026-0834) — CRITICAL
- [North Korean Threat Actors Weaponize Developer Tools (VS Code, npm, GitHub) for Cross-Platform Malware Delivery — Contagious Interview / UNK_DeadDrop](https://intel.threadlinqs.com/threat/TL-2026-0813) — HIGH
- [Sapphire Sleet (DPRK/BlueNoroff) macOS Intrusion Campaign Targeting Cryptocurrency, Web3, and Venture Capital Sectors](https://intel.threadlinqs.com/threat/TL-2026-0383) — HIGH
- [Axios npm Supply Chain Compromise — WAVESHAPER.V2 Cross-Platform RAT Deployment by UNC1069/Sapphire Sleet (DPRK)](https://intel.threadlinqs.com/threat/TL-2026-0314) — CRITICAL

## Full data

Infrastructure, IOC values and detection queries (Splunk SPL / Microsoft KQL / Sigma) require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/actor/TA444