APT38G0082 state

About this actor

[APT38](https://attack.mitre.org/groups/G0082) is a North Korean state-sponsored threat group that specializes in financial cyber operations; it has been attributed to the Reconnaissance General Bureau.(Citation: CISA AA20-239A BeagleBoyz August 2020) Active since at least 2014, [APT38](https://attack.mitre.org/groups/G0082) has targeted banks, financial institutions, casinos, cryptocurrency exchanges, SWIFT system endpoints, and ATMs in at least 38 countries worldwide. Significant operations include the 2016 Bank of Bangladesh heist, during which [APT38](https://attack.mitre.org/groups/G0082) stole $81 million, as well as attacks against Bancomext (Citation: FireEye APT38 Oct 2018) and Banco de Chile (Citation: FireEye APT38 Oct 2018); some of their attacks have been destructive.(Citation: CISA AA20-239A BeagleBoyz August 2020)(Citation: FireEye APT38 Oct 2018)(Citation: DOJ North Korea Indictment Feb 2021)(Citation: Kaspersky Lazarus Under The Hood Blog 2017) North Korean group definitions are known to have significant overlap, and some security researchers report all North Korean state-sponsored cyber activity under the name [Lazarus Group](https://attack.mitre.org/groups/G0032) instead of tracking clusters or subgroups.

Source: MITRE ATT&CK

Activity timeline

• 2026 — 1 CVE published
• 2016 — 1 CVE published

Profile

Mitigating controls (NIST 800-53)

Co-occurring actors

• Mustang Panda 1 shared CVEs
• SolarWinds Compromise 1 shared CVEs
• Tonto Team 1 shared CVEs
• Ember Bear 1 shared CVEs
• GOLD SOUTHFIELD 1 shared CVEs
• Aquatic Panda 1 shared CVEs
• APT28 1 shared CVEs
• Sandworm Team 1 shared CVEs
• Ajax Security Team 1 shared CVEs
• FIN7 1 shared CVEs

Similar actors