APT38
MITREUnknown
Unknown
Unknown
[APT38](https://attack.mitre.org/groups/G0082) is a North Korean state-sponsored threat group that specializes in financial cyber operations; it has been attributed to the Reconnaissance General Bureau.(Citation: CISA AA20-239A BeagleBoyz August 2020) Active since at least 2014, [APT38](https://attack.mitre.org/groups/G0082) has targeted banks, financial institutions, casinos, cryptocurrency exchanges, SWIFT system endpoints, and ATMs in at least 38 countries worldwide. Significant operations include the 2016 Bank of Bangladesh heist, Bancomext (Citation: FireEye APT38 Oct 2018) and Banco de Chile (Citation: FireEye APT38 Oct 2018), along with software supply chain compromises and destructive malware attacks.(Citation: CISA AA20-239A BeagleBoyz August 2020)(Citation: FireEye APT38 Oct 2018)(Citation: DOJ North Korea Indictment Feb 2021)(Citation: Kaspersky Lazarus Under The Hood Blog 2017)(Citation: Microsoft Axios Compromise APR 2026)(Citation: Microsoft Sapphire Sleet APR 2026)(Citation: MIcrosoft Mastra npm Compromise JUN 2026)
North Korean group definitions are known to have significant overlap, and some security researchers report all North Korean state-sponsored cyber activity under the name [Lazarus Group](https://attack.mitre.org/groups/G0032) instead of tracking clusters or subgroups.
Tecniche Utilizzate (120)
| ID | ATT&CK | Tattiche |
|---|---|---|
| T1005 | Data from Local System | - |
| T1012 | Query Registry | - |
| T1027.002 | Software Packing | - |
| T1027.010 | Command Obfuscation | - |
| T1027.015 | Compression | - |
| T1027.016 | Junk Code Insertion | - |
| T1033 | System Owner/User Discovery | - |
| T1036.003 | Rename Legitimate Utilities | - |
| T1036.005 | Match Legitimate Resource Name or Location | - |
| T1036.006 | Space after Filename | - |
| T1036.008 | Masquerade File Type | - |
| T1041 | Exfiltration Over C2 Channel | - |
| T1048.002 | Exfiltration Over Asymmetric Encrypted Non-C2 Protocol | - |
| T1049 | System Network Connections Discovery | - |
| T1053.003 | Cron | - |
Alias (3612)
Malware Utilizzato (6)
other
other
other
other
tool
tool
Metadata
| ID: | 889 |
| Created: | 13/01/2026 17:48 |
| Updated: | 11/11/2026 16:00 |