Alluring Pisces
Alluring Pisces is a North Korea-attributed threat actor tracked under numerous aliases including Lazarus Group, Lazarus, Lazarus APT, BlueNoroff, Sapphire Sleet, APT38, BeagleBoyz, Hidden Cobra, Diamond Sleet, Jade Sleet, Moonstone Sleet, Citrine Sleet, AppleJeus, CryptoCore, Copernicium, Labyrinth Chollima, Stardust Chollima, UNC1069, UNC1720, UNC4736, Storm-0139, Storm-0954, Storm-1222, Storm-1789, Guardians of Peace, Black Artemis, CageyChameleon, Gleaming Pisces, Nickel Academy, Nickel Gladstone, and Zinc. The provided content attributes the actor to North Korea and describes motivations of financial gain and espionage, with targeting focused on finance, cryptocurrency, and defense. Mentioned malware and operations include WannaCry, Hermes, BLINDINGCAN, and campaigns such as Operation AppleJeus and Dream Job. Supporting reporting in the content also links Alluring Pisces to BlueNoroff and Sapphire Sleet, and notes prior attribution of the RustDoor backdoor to this actor. The content states that Lazarus Group is associated with extensive ATT&CK coverage, with 80+ techniques and usage relationships.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Tradecraft
100 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Associated malware families
4 malware families attributed to this actor across reporting.
Recent activity
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Used as an example of a mature intrusion set profile in OpenCTI, associated with financial gain and espionage, targeting finance, cryptocurrency, and defense sectors.
Referenced in the post author name 'lazarusholic' and the content discusses tooling linked to North Korean actors, but no concrete operational details about Lazarus are provided in the content.
Referenced as a DPRK-affiliated group using similar initial infection vectors, specifically LinkedIn/GitHub-style social engineering tactics.
Referenced as a North Korea-linked threat actor to which RustDoor has been previously attributed; the broader activity described involves recruiter-style social engineering against job-seeking software developers in the cryptocurrency sector, delivering macOS malware (RustDoor and a macOS variant of Koi Stealer) for credential and crypto-wallet theft and data exfiltration.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.