APT38 is the name FireEye introduced in 2018 for a distinct, financially motivated North Korean state-sponsored activity cluster separated from its broader espionage tracking. FireEye traced operations to February 2014 and described compromises of more than sixteen organizations across at least thirteen countries, with banks and other financial institutions as the central targets. The group's objective is to manipulate interbank systems and raise large sums for the North Korean regime. Early work emphasized learning financial environments in Southeast Asia; later operations expanded globally and became more complex, specialized, and destructive. APT38 conducts extensive personnel and vendor research, uses watering holes or vulnerable servers for access, maps networks, maintains long dwell times, and closely studies transaction systems. It deploys custom backdoors and monitoring tools, pivots to SWIFT servers, alters transaction records to conceal fraudulent transfers, and may finish by securely deleting artifacts, clearing logs, deploying wipers, or using ransomware as misdirection and evidence destruction.