Loading story…
A public GitHub repository has surfaced with a basic server emulator for SHATTEREDGLASS, a ransomware family attributed to North Korea-linked Andariel. The repository explicitly identifies the malware as SHATTEREDGLASS and ties it to external threat intelligence and malware-tracking sources, adding fresh public tooling and documentation around a ransomware strain associated with DPRK operations.
Google Cloud’s Mandiant reporting describes APT45/Andariel as a long-running North Korean threat group active since at least 2009, with operations spanning government, defense, financial, healthcare, pharmaceutical, agricultural, energy, and nuclear targets. The report says the group stands out among DPRK operators for its suspected interest in ransomware, and the newly surfaced SHATTEREDGLASS emulator reinforces the public linkage between Andariel/APT45 and ransomware activity alongside its broader espionage and disruptive mission set.
TTPs, infrastructure, and targeting history in one profile.
13 events from the most recent confirmed update back to the earliest known activity.
The GitHub repository's latest visible commit, "Update README.md," is dated July 29, 2024 and describes the project as a basic server emulator for SHATTEREDGLASS attributed to Andariel.
On July 25, 2024, Google Cloud's Mandiant published a profile of APT45 describing the group as unusual among North Korean operators for its suspected interest in ransomware, while noting some ransomware-linked attribution remains unconfirmed.
The GitHub repository shows the file Unidentified081.php was added via upload on April 14, 2023 as part of a SHATTEREDGLASS server emulator project.
Mandiant said activity observed in 2023 indicated APT45 maintained interest in health-related research targets.
In 2022, CISA reported that North Korean state-sponsored actors used MAUI ransomware to target the healthcare and public health sectors.
During a suspected COVID-19 outbreak in North Korea in 2021, multiple North Korea-linked operators including APT45 focused on healthcare and pharmaceutical targets.
Mandiant identified APT45 spear-phishing a South Asian bank in 2021, showing the group's continued direct targeting of financial entities.
In 2021, Kaspersky reported on ransomware that Mandiant tracks as SHATTEREDGLASS, stating it had been used by suspected APT45-linked clusters.
Mandiant reported that APT45 targeted the crop science division of a multinational corporation in September 2020.
In 2019, APT45 directly targeted nuclear research facilities and nuclear power plants, including the Kudankulam Nuclear Power Plant in India.
Mandiant said APT45 showed a clearer operational focus on government agencies and the defense industry beginning in 2017.
In 2016, APT45 likely leveraged RIFLE to target a South Korean financial organization, reflecting the group's financially motivated operations.
Mandiant reported that malware samples indicate the North Korea-linked APT45 threat group was active by 2009.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
github.com
Open sourcecloud.google.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
North Korean threat actors have expanded from distinct intrusion sets into overlapping cyber operations that mix espionage, financial theft, and targeted ransomware while reusing malware, infrastructure, and delivery tradecraft. Research across Lazarus, Kimsuky, APT43, and related DPRK-linked clusters shows campaigns against governments, think tanks, defense-linked individuals, banks, cryptocurrency firms, and South Korea-focused political and academic targets. Analysts tied these operations to spear-phishing with Word, HWP, ZIP, and password-protected archive lures; trojanized cryptocurrency software in the **AppleJeus** family; bank intrusions associated with **Bluenoroff** and SWIFT fraud; and crypto theft campaigns such as **CryptoCore**. Trellix also linked several narrowly targeted ransomware families to North Korea’s financial cyber apparatus, reinforcing the regime’s dual use of cyber operations for intelligence collection and revenue generation. Recent reporting shows attribution is becoming harder because DPRK operators increasingly share tools and infrastructure across sub-clusters and adapt quickly to evade detection. Kimsuky campaigns used **AppleSeed**, **AlphaSeed**, **GoldDragon**, and **DEEP#GOSU** infection chains with cloud-hosted staging, `mshta.exe`, PowerShell, VBS, Dropbox, Google Docs, fake Blogspot pages, and strict victim-validation logic, while a later Korea-focused phishing operation combined Facebook, email, and Telegram to deliver obfuscated JSE malware. Separate analysis described a late-2023 crypto supply-chain intrusion delivering the **Durian** Golang RAT with signs of collaboration between Kimsuky and Andariel, and another case where **PEBBLEDASH**, long associated with Lazarus, appeared alongside Kimsuky-linked infrastructure. Researchers concluded that malware names alone no longer reliably identify the operator and that accurate attribution now depends on reconstructing the full intrusion chain, infrastructure, targeting, and strategic objective.
Aug 15, 2026
Researchers tied multiple malware samples used against South Korean organizations to two related Lazarus/Andariel families, **TigerDownloader** and **TigerRAT**, consolidating activity previously reported separately by Malwarebytes, Kaspersky, and KrCERT. The intrusions commonly began with Korean-language spearphishing documents that abused macros, saved content as HTML, extracted hidden objects from image files, and launched payloads through `mshta.exe`; in other cases, Lazarus-linked operators also used watering-hole and supply-chain delivery paths involving compromised Korean websites and software distribution mechanisms. Threat analysts found shared packing and decryption logic across the downloader and RAT families, including XOR- and Base64-based unpacking, while the implants used HTTP command-and-control and masqueraded traffic or payloads as benign content such as GIF uploads. The malware provided broad remote access capabilities including shell execution, file management, screen capture, keylogging, SOCKS tunneling, port forwarding, self-deletion, and system reconnaissance, with some variants adding persistence through startup shortcuts and others introducing small command-and-control protocol changes such as the `n0gyPPx` registration check. Securelist also documented Andariel deploying a custom ransomware payload in at least one South Korea-focused intrusion, showing the subgroup combining espionage-style access with financially motivated operations. The reporting strengthens attribution of these campaigns to **Andariel**, a Lazarus subgroup, based on code overlap, encryption routines, post-exploitation tradecraft, and long-running targeting patterns against South Korean government, enterprise, and web infrastructure.
Aug 15, 2026
North Korea-aligned **Andariel**, a subgroup linked to **Lazarus**, conducted multiple intrusion campaigns against South Korean organizations across manufacturing, construction, education, defense, telecommunications, semiconductor, shipbuilding, electronics, and ICT sectors. Reporting from AhnLab ties the activity together through recurring victimology, repeated abuse of vulnerable or trusted enterprise software such as **INNORIX Agent**, domestic asset-management tools, software update mechanisms, and in one case an outdated **Apache Tomcat** web server. The campaigns also showed likely spearphishing, use of hidden accounts and scheduled tasks for persistence, and credential theft followed by lateral movement and remote desktop access. The operators deployed an evolving malware set that included **Goat RAT**, **AndarLoader**, **DurianBeacon**, **Nestdoor**, **Dora RAT**, **SmallTiger**, **TigerRat**, **NukeSped** variants, **Black RAT**, **Lilith RAT**, and supporting tools such as **PrintSpoofer**, **Mimikatz**, **ProcDump**, **Meterpreter**, proxy utilities, keyloggers, clipboard stealers, and browser credential theft tools. AhnLab reported overlaps in command-and-control infrastructure and malware staging, including **DurianBeacon** delivering **AndarLoader**, **SmallTiger** fetching payloads in memory, and some Dora RAT samples being disguised as legitimate software like **OpenVPN** and signed with valid certificates. The activity reflects a continued shift in Andariel tooling while preserving long-standing tradecraft associated with Lazarus operations.
Aug 15, 2026