← Back to Actors
APT38
APT38NICKEL GLADSTONEBeagleBoyzBluenoroffStardust ChollimaSapphire SleetCOPERNICIUM
[APT38](https://attack.mitre.org/groups/G0082) is a North Korean state-sponsored threat group that specializes in financial cyber operations; it has been attributed to the Reconnaissance General Bureau.(Citation: CISA AA20-239A BeagleBoyz August 2020) Active since at least 2014, [APT38](https://attack.mitre.org/groups/G0082) has targeted banks, financial institutions, casinos, cryptocurrency exchanges, SWIFT system endpoints, and ATMs in at least 38 countries worldwide. Significant operations include the 2016 Bank of Bangladesh heist, Bancomext (Citation: FireEye APT38 Oct 2018) and Banco de C...
120
Techniques
103
Covered
17
Gaps
86%
Coverage
Coverage103/120
GAPS (17)
T1027.016Junk Code InsertionT1048.002Exfiltration Over Asymmetric Encrypted Non-C2 ProtocolT1213.005Messaging ApplicationsT1480.002Mutual ExclusionT1562.013Disable or Modify Network Device FirewallT1564.011Ignore Process InterruptsT1564.012File/Path ExclusionsT1565.003Runtime Data ManipulationT1583.003Virtual Private ServerT1585.001Social Media AccountsT1585.002Email AccountsT1677Poisoned Pipeline ExecutionT1678Delay ExecutionT1683.001Written ContentT1683.002Audio-Visual ContentT1684.001ImpersonationT1685.003Modify or Spoof Tool UI
COVERED (103)
T1005Data from Local System51 det.T1012Query Registry25 det.T1027.002Software Packing2 det.T1027.010Command Obfuscation42 det.T1027.015Compression2 det.T1033System Owner/User Discovery62 det.T1036.003Rename Legitimate Utilities47 det.T1036.005Match Legitimate Resource Name or Location49 det.T1036.006Space after Filename3 det.T1036.008Masquerade File Type5 det.T1041Exfiltration Over C2 Channel32 det.T1049System Network Connections Discovery23 det.T1053.003Cron29 det.T1053.005Scheduled Task100 det.T1053.006Systemd Timers6 det.T1055Process Injection83 det.T1056.001Keylogging4 det.T1056.002GUI Input Capture5 det.T1057Process Discovery24 det.T1059.001PowerShell384 det.T1059.002AppleScript26 det.T1059.003Windows Command Shell89 det.T1059.004Unix Shell177 det.T1059.005Visual Basic71 det.T1059.006Python55 det.T1059.007JavaScript64 det.T1070.001Clear Windows Event Logs16 det.T1070.003Clear Command History15 det.T1070.004File Deletion46 det.T1070.006Timestomp10 det.T1071.001Web Protocols83 det.T1074.001Local Data Staging10 det.T1078.003Local Accounts24 det.T1078.004Cloud Accounts200 det.T1082System Information Discovery91 det.T1083File and Directory Discovery49 det.T1105Ingress Tool Transfer199 det.T1106Native API30 det.T1110Brute Force100 det.T1112Modify Registry208 det.T1115Clipboard Data16 det.T1124System Time Discovery4 det.T1132.001Standard Encoding5 det.T1135Network Share Discovery20 det.T1140Deobfuscate/Decode Files or Information59 det.T1189Drive-by Compromise13 det.T1195.001Compromise Software Dependencies and Development Tools10 det.T1204.001Malicious Link11 det.T1204.002Malicious File468 det.T1213.006Databases2 det.T1217Browser Information Discovery4 det.T1218.001Compiled HTML File14 det.T1218.005Mshta51 det.T1218.007Msiexec37 det.T1218.011Rundll3278 det.T1222.002Linux and Mac Permissions19 det.T1480Execution Guardrails1 det.T1485Data Destruction100 det.T1486Data Encrypted for Impact400 det.T1505.003Web Shell70 det.T1518Software Discovery17 det.T1518.001Security Software Discovery11 det.T1529System Shutdown/Reboot19 det.T1543.001Launch Agent14 det.T1543.003Windows Service80 det.T1543.004Launch Daemon12 det.T1546.016Installer Packages9 det.T1547.001Registry Run Keys / Startup Folder53 det.T1548.002Bypass User Account Control84 det.T1548.003Sudo and Sudo Caching54 det.T1548.006TCC Manipulation3 det.T1552.003Shell History3 det.T1552.004Private Keys23 det.T1553.005Mark-of-the-Web Bypass12 det.T1555Credentials from Password Stores43 det.T1555.001Keychain7 det.T1555.003Credentials from Web Browsers16 det.T1560.001Archive via Utility27 det.T1561.002Disk Structure Wipe3 det.T1562.001Disable or Modify Tools332 det.T1562.003Impair Command History Logging3 det.T1562.004Disable or Modify System Firewall50 det.T1564.003Hidden Window11 det.T1565.001Stored Data Manipulation23 det.T1565.002Transmitted Data Manipulation3 det.T1566.001Spearphishing Attachment1144 det.T1566.002Spearphishing Link1194 det.T1566.003Spearphishing via Service107 det.T1567Exfiltration Over Web Service53 det.T1569.002Service Execution65 det.T1571Non-Standard Port17 det.T1583.001Domains69 det.T1583.006Web Services1 det.T1586.003Cloud Accounts36 det.T1588.002Tool13 det.T1608.001Upload Malware3 det.T1620Reflective Code Loading17 det.T1657Financial Theft15 det.T1685Disable or Modify Tools281 det.T1685.005Clear Windows Event Logs12 det.T1686Disable or Modify System Firewall19 det.T1686.002Network Device Firewall2 det.T1690Prevent Command History Logging3 det.