eset_apt_activity_report_q42022_q12023.pdf (4 MB)

ESET’s Q4 2022–Q1 2023 APT activity report says North Korea-aligned groups ScarCruft, Andariel, and Kimsuky continued targeting South Korean and South Korea-related entities with established toolsets. The Lazarus section highlights a fake Boeing-themed job offer against employees of a defense contractor in Poland, a shift toward a data management company in India using an Accenture-themed lure, and Linux malware used in one Lazarus campaign. The broader report also notes that North Korean activity remained one part of a multi-actor APT landscape alongside China-, India-, Iran-, and Russia-aligned operations, so DPRK-specific tracking should focus on those North Korea-aligned sections rather than the full document.