Andariel

Andariel is a North Korea-linked threat actor and a sanctioned DPRK state-sponsored malicious cyber group. The provided content identifies Andariel as associated with North Korea and notes OFAC added it to the SDN List in September 2019. Treasury reporting in the content describes Andariel as one of two subsidiaries of Lazarus Group, alongside Bluenoroff, and states that Lazarus Group, Bluenoroff, and Andariel stole around $700 million over three years and attempted to steal nearly $2 billion. Known aliases in the provided content include APT45, Black Chollima, DarkSeoul, Jumpy Pisces, Onyx Sleet, PLUTONIUM, Silent Chollima, Stonefly, and TDrop2 campaign. Microsoft naming reflected in the content maps the actor to the North Korea-attributed Sleet family via the alias Onyx Sleet. The content describes Andariel conducting spearphishing campaigns using malicious Word or Excel attachments and attempting to lure victims into enabling malicious macros in email attachments. It also states that Andariel used tasklist to enumerate processes and search for a specific string, and collected large numbers of files from compromised network systems for later extraction. Recent activity in the provided reporting says ESET uncovered the reemergence of Andariel in South Korea, where the group deployed TigerRAT and attempted to spread Rook ransomware within a South Korean engineering company. The targeted company reportedly appeared to manufacture equipment relevant to liquid hydrogen handling and the nuclear industry. Separate reporting in the content also says Play has recently been linked to the North Korea-aligned group Andariel. The content further states that APT45, identified as DPRK-aligned and described in one source as North Korea’s military hacking group, used AI systems operationally by sending thousands of repetitive prompts to recursively analyze CVEs and validate proof-of-concept exploits at industrial scale, building a durable exploit arsenal.