Loading threat actor…
Sapphire Sleet is a North Korean state-sponsored threat actor associated with financially motivated cyber operations, particularly cryptocurrency theft. The group is also widely tracked as BlueNoroff and Stardust Chollima, and has been referred to as CageyChameleon and Alluring Pisces. It has been linked to North Korea’s remote IT worker schemes and to software supply-chain intrusions designed to achieve downstream access at scale. Sapphire Sleet has been attributed with multiple compromises in the npm ecosystem, including separate campaigns involving widely used JavaScript packages and a smaller typo-squatted package believed to have served as an early testing ground. In these operations, the actor reportedly socially engineered package maintainers, inserted trojanized updates into trusted packages, and used post-install execution to deliver additional payloads. Observed tradecraft included multi-stage malware delivery, runtime retrieval of second-stage payloads, operating-system-aware payload selection, code reuse across campaigns, and the use of overlapping command-and-control artifacts and tactics, techniques, and procedures. The group’s supply-chain activity reflects mature defense-evasion practices, including stronger encryption and anti-analysis methods, externalized payload logic, and fragmented malicious workflows spread across multiple packages to reduce detectability. Sapphire Sleet’s targeting of highly popular open-source dependencies indicates an effort to maximize indirect victim reach through trusted software distribution channels. Its operations are consistent with a financially motivated DPRK-linked actor seeking scalable access for theft-oriented follow-on activity.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Attributed origin per open-source reporting.
No public activity tracked yet. Mallory keeps watching.
No public activity observed for this threat actor.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.