UNC614 is Mandiant’s designation for the North Korean actor publicly associated with Andariel and DarkSeoul and assessed as part of the Reconnaissance General Bureau. Mandiant describes the group as distinct from other overlapping North Korean clusters and focused primarily on military, government, defense, aerospace, nuclear, and advanced research targets. Its strategic collection supports weapons-development and other research priorities, although the actor has also conducted self-funding cybercrime, including ransomware activity against healthcare organizations. In 2022, Mandiant linked UNC614 to QUINSTATUS malware delivered through a malicious document likely targeting a major pharmaceutical company; related analysis also identified the MARBLEROCK and SWEETPEA families. The broader cluster attacks foreign businesses, government agencies, financial infrastructure, private companies, and the defense industry. Its operations combine espionage, technology acquisition, tailored malware, and opportunistic revenue generation while retaining a strong focus on sensitive military and scientific information.