Andariel Threat Actor Profile: Tactics, Tools, Targets

Andariel, also known as APT45 and Onyx Sleet, is a North Korean state-sponsored threat group operating under the Reconnaissance General Bureau (RGB). Historically focused on South Korean entities, the group has expanded its global reach to target critical infrastructure in the U.S., Japan, India, and Taiwan. Their mission serves a dual purpose: gathering sensitive intelligence on military, nuclear, and engineering projects while simultaneously generating illicit revenue through ransomware attacks against sectors such as healthcare.

The group's operational tradecraft is sophisticated, utilizing a vast array of custom malware like Dtrack and Rifdoor, alongside publicly available tools and the exploitation of critical vulnerabilities (e.g., Log4Shell). Recent law enforcement actions, including the 2024 indictment of Rim Jong Hyok, highlight the group's involvement in laundering ransomware proceeds through China-based facilitators to fund further espionage infrastructure. Organizations in defense industrial bases and healthcare remain at high risk from this persistent threat.