Andariel allegedly targeted a Chinese energy company in a wider North Korean Reconnaissance General Bureau-linked intrusion set that also involved healthcare ransomware, defense, technology, government, and manufacturing victims. U.S. prosecutors said the actors used laundered Maui ransomware proceeds to lease infrastructure for additional intrusions and exploited unpatched known vulnerabilities, including Log4Shell, while stealing sensitive data across targets.