UNC1720
2023-10-10 • Mandiant • Assessed Cyber Structure and Alignments of North …
UNC1720 is an uncategorized cluster designation used by Mandiant that corresponds to the publicly reported AppleJeus activity, assessed to have been active since at least 2018. The group primarily targets the cryptocurrency industry, using spear-phishing emails and fake cryptocurrency trading software to infiltrate victim systems and steal digital assets intended to fund the North Korean regime's priorities. Mandiant assesses that this crypto-focused activity emerged after the notoriety surrounding the Bangladesh Bank heist exposed the difficulty of stealing and laundering traditional currency at scale, prompting a shift toward direct theft of cryptocurrency. The group's tooling overlaps with that used by TEMP.Hermit, though the two clusters are not focused on the same targeting profiles, which Mandiant suggests may indicate the sharing of development resources between otherwise distinct North Korean cyber operators rather than a single unified group.
-
60
Related Actors
-
2
Related Reports
Related Actors
Related Reports
Top Authors
View all reports in this cluster