Threat Actor Characterization
Andariel
ID: 8ebad4679004dd23b57cae31fc26a9c103951| Onyx Sleet | PLUTONIUM | Si************* | — |
Actor Network Graph
Open Network GraphMITRE ATT&CK®
Silent Chollima / Andariel — DPRK-linked group with espionage and revenue operations; spearphishing and exploitation of public-facing apps, valid accounts, custom loaders/backdoors, and data exfiltration are routinely observed.
| Technique | Technique name | Tactics | Evidence |
|---|---|---|---|
| T1566 | Phishing | TA0001 |
|
| T1190 | Exploit Public-Facing Application | TA0001 |
|
| T1078 | Valid Accounts | TA0001 TA0003 TA0004 TA0005 |
|
| T1105 | Ingress Tool Transfer | TA0011 |
|
| T1041 | Exfiltration Over C2 Channel | TA0010 |
|
| T1486 | Data Encrypted for Impact | TA0040 |
|
CLASSIFICATION: Unclassified / Open Source
Executive Summary
Silent Chollima (a.k.a. Andariel, Silent PLUTONIUM, Onyx Sleet) is a North Korea–linked threat group conducting both espionage and revenue-generation operations, including banking theft and ransomware-style impact. Open sources and MITRE note consistent use of spearphishing, public-facing app exploitation, valid-account abuse, and custom loaders/backdoors, with living-off-the-land behavior and tunneling. Target sectors include defense, manufacturing, financial, and South Korea–focused entities, with activity spanning 2015–2025. Confidence: high (MITRE G0138 + vendor/LE reporting).
State-linked cluster aligned with DPRK intelligence/economic goals; overlaps in tooling/infrastructure with other DPRK groups are documented in public research, complicating granular attribution.