Andariel
- ID
- G0138
- Associated names
- Silent Chollima, PLUTONIUM, Onyx Sleet
- Source
- attack.mitre.org
- MITRE last modified
- 1 Aug 2026
Andariel is a North Korean state-sponsored threat group that has been active since at least 2009. Andariel has primarily focused its operations--which have included destructive attacks--against South Korean government agencies, military organizations, and a variety of domestic companies; they have also conducted cyber financial operations against ATMs, banks, and cryptocurrency exchanges. Andariel's notable activity includes Operation Black Mine, Operation GoldenAxe, and Campaign Rifle.[1][2][3][4][5]
Andariel is considered a sub-set of Lazarus Group, and has been attributed to North Korea's Reconnaissance General Bureau.[6]
North Korean group definitions are known to have significant overlap, and some security researchers report all North Korean state-sponsored cyber activity under the name Lazarus Group instead of tracking clusters or subgroups.
Techniques used (12)
- T1005 Data from Local System
- T1027.003 Steganography
- T1049 System Network Connections Discovery
- T1057 Process Discovery
- T1105 Ingress Tool Transfer
- T1189 Drive-by Compromise
- T1203 Exploitation for Client Execution
- T1204.002 Malicious File
- T1566.001 Spearphishing Attachment
- T1588.001 Malware
- T1590.005 IP Addresses
- T1592.002 Software