Threadlinqs IntelligenceStart free

Threat actorNorth Korea (DPRK)Tracked since 2026-04

UNC5342

As of 2026-09-13, UNC5342 is a North Korea (DPRK)-nexus threat actor tracked by Threadlinqs Intelligence across 7 threats spanning threat intel, malware, supply chain. ATT&CK coverage spans 83 techniques across 13 tactics in 7 of 7 tracked threats. Most-observed techniques: T1027 (Obfuscated Files or Information), T1140 (Deobfuscate/Decode Files or Information), T1041 (Exfiltration Over C2 Channel).

Tracked threats
77 high
First seen
2026-04-21
Last seen
2026-09-13
ATT&CK techniques
83across 7 of 7 threats
Related CVEs
0None referenced
Attribution
North Korea (DPRK)Nation or origin
Nation: North Korea (DPRK) · 7 tracked threat(s) · Categories: THREAT_INTEL, MALWARE, SUPPLY_CHAIN, APT

Activity timeline

UNC5342 appears in 7 tracked threats between and ; the busiest month was 2026-07 with 3 reports.

ATT&CK techniques observed

83 techniques observed across 7 of 7 tracked threats · Command and Control (12), Resource Development (12), Stealth (formerly Defense Evasion) (10), Initial Access (9), Credential Access (8), Execution (8)
  • T1027 Obfuscated Files or Information — Stealth (formerly Defense Evasion)observed in 7 of 7 tracked threats
  • T1140 Deobfuscate/Decode Files or Information — Stealth (formerly Defense Evasion)observed in 6 of 7 tracked threats
  • T1041 Exfiltration Over C2 Channel — Exfiltrationobserved in 5 of 7 tracked threats
  • T1005 Data from Local System — Collectionobserved in 4 of 7 tracked threats
  • T1059.007 JavaScript — Executionobserved in 4 of 7 tracked threats
  • T1082 System Information Discovery — Discoveryobserved in 4 of 7 tracked threats
  • T1083 File and Directory Discovery — Discoveryobserved in 4 of 7 tracked threats
  • T1102 Web Service — Command and Controlobserved in 4 of 7 tracked threats
  • T1105 Ingress Tool Transfer — Command and Controlobserved in 4 of 7 tracked threats
  • T1555.003 Credentials from Web Browsers — Credential Accessobserved in 4 of 7 tracked threats
  • T1567 Exfiltration Over Web Service — Exfiltrationobserved in 4 of 7 tracked threats
  • T1573 Encrypted Channel — Command and Controlobserved in 4 of 7 tracked threats
  • T1657 Financial Theft — Impactobserved in 4 of 7 tracked threats
  • T1036 Masquerading — Stealth (formerly Defense Evasion)observed in 3 of 7 tracked threats
  • T1059 Command and Scripting Interpreter — Executionobserved in 3 of 7 tracked threats

Tracked threats