ValidAlpha is a custom malware family that Microsoft attributes to Onyx Sleet, a North Korea-linked actor also associated with Andariel. It appeared in reporting on attacks against South Korean defense contractors and broader Onyx Sleet operations concentrated in South Korea. The actor uses custom malware alongside exploitation of remote-desktop, remote-management, data-loss-prevention, network-access-control, and endpoint-security products. ValidAlpha belongs to this intrusion toolkit, which supports initial compromise, persistence, remote operation, and collection in defense-focused espionage campaigns.