Andariel is a threat group that the Korean Financial Security Institute designated as a subgroup of Lazarus, as Kaspersky reported in 2021. AhnLab described it in 2018 as active since 2015 and linked its activity to earlier operations against South Korean organizations. Its targets span military and defense bodies, political organizations, security and technology companies, energy research, banks, cash machines, cryptocurrency exchanges, and other financially relevant businesses. Characteristic access methods include spear-phishing documents with macros, watering holes that exploit locally used ActiveX software, attacks on centralized management products, and supply-chain compromise. By 2018 it was also expanding reconnaissance beyond Internet Explorer, collecting browser and software details from compromised Korean websites. Activity observed from 2020 into 2021 showed further evolution toward staged in-memory loaders, interactive backdoor use, and selectively deployed custom ransomware, combining intelligence collection with direct financial gain.
South Korean Manufacturing Company
#SouthKoreanManufacturing • 2023-03
🇰🇷 Korea, Republic of
The South Korean manufacturing intrusion was included in a U.S. Justice Department case charging Rim Jong Hyok and co-conspirators over an Andariel campaign tied to North Korea’s Reconnaissance General Bureau. The indictment alleged that proceeds from Maui ransomware extortion were laundered through China-based facilitators and used to lease infrastructure for further intrusions, including against South Korean manufacturing, defense, technology, government, and energy targets, with exploitation of known vulnerabilities such as Log4Shell and theft of sensitive data.
-
1
Related Reports
-
1
Affected Countries
-
41
Months Since
Related Actors
First seen: 2017-07 •
Last seen: 2026-06
Related Reports
2024-07-25
USJustice