Andariel: Ransomware, Espionage, and North Korean Cyber Operations

Andariel is frequently summarized as a North Korean hacking group, a Lazarus subgroup, an espionage actor, or a ransomware operator. Each description captures part of the public record, but none is precise enough by itself. The name sits inside overlapping government and vendor taxonomies, and those sources do not always assign the same activity with the same confidence.

For defenders, the useful question is not which alias wins. It is which behaviors have been credibly reported, what mission they may support, and which evidence would confirm that a similar path exists in the organization's own environment.

Executive Answer

Andariel is a North Korean state-sponsored threat group associated with the Reconnaissance General Bureau and active since at least 2009. MITRE tracks it as G0138 and considers it a subset of Lazarus Group, while Mandiant calls overlapping activity APT45 and Microsoft uses Onyx Sleet. Its core mission is strategic espionage against defense, aerospace, nuclear, engineering, government, and technology targets. U.S. authorities also connect an Andariel unit to Maui ransomware attacks on healthcare organizations, alleging that ransom proceeds funded later espionage. These labels overlap, but they are not automatically interchangeable.

Andariel at a Glance

DeepStrike's broader Lazarus Group profile explains the umbrella label and its wider history. This article owns the narrower Andariel entity, its dual mission, and the evidence defenders need to distinguish an actor hypothesis from an incident fact.

Who Is Andariel?

MITRE ATT&CK describes Andariel as a North Korean state-sponsored threat group active since at least 2009. Its historical operations have included destructive attacks against South Korean government, military, and commercial organizations, along with financial activity affecting ATMs, banks, and cryptocurrency exchanges. MITRE assigns the group ID G0138 and describes it as a subset of Lazarus Group attributed to the Reconnaissance General Bureau. The profile was last modified July 31, 2026. See the current MITRE ATT&CK Andariel profile.

The U.S. Treasury took a policy and sanctions view in September 2019. It identified Andariel, Lazarus Group, and Bluenoroff as agencies, instrumentalities, or controlled entities of the North Korean government based on their relationship to the RGB. Treasury described Andariel as a Lazarus subgroup that conducted both revenue-generating cybercrime and intelligence collection, particularly against South Korean government and military targets. That is an official designation, not a complete technical organization chart.

Mandiant uses APT45 for a long-running cluster it assesses with high confidence to support North Korean state interests and with moderate confidence to be attributable specifically to the RGB. Its research traces activity to at least 2009 and emphasizes a relatively distinct malware lineage, shifting target priorities, and an unusual combination of espionage with suspected ransomware development. The Mandiant APT45 assessment is therefore close to, but not necessarily identical with, every use of “Andariel.”

The practical conclusion is narrow: Andariel is not merely a media nickname and not simply a malware family. It is an attribution label for a long-running North Korean activity set whose exact edges depend on the reporting source.

Andariel, APT45, Onyx Sleet, and Lazarus: The Naming Problem

Threat-actor names are analytical models. Governments, MITRE, and security vendors cluster evidence using different visibility, thresholds, time windows, and purposes. One source may group activity by sponsor or unit; another may split it by infrastructure, malware lineage, or victimology.

The July 2024 joint advisory made this limitation explicit. It said the cybersecurity industry uses overlapping names including Andariel, Onyx Sleet, and DarkSeoul for activity associated with the RGB 3rd Bureau, but warned that vendor groupings may not correlate 1:1 with the U.S. government's understanding. The NSA announcement for the joint advisory preserves that boundary.

Microsoft's own 2024 profile says other security companies track Onyx Sleet as APT45, Silent Chollima, Andariel, DarkSeoul, Stonefly, and TDrop2. It also reports operational overlap with Storm-0530, a separate cluster associated with H0lyGh0st ransomware. An observed relationship is not the same as identity, and a tool used by both does not collapse the groups into one.

The safest writing rule is simple: retain the original source's name, date, and confidence. For incident response, record three conclusions separately what happened, which technical cluster best fits, and which sponsor or unit a government or vendor attributes it to.

A Timeline of Andariel's Publicly Reported Evolution

The 2019 Treasury action remains an important anchor because it publicly tied the Andariel label to the RGB and described both revenue and intelligence objectives. Its sanctions announcement should be read as dated official attribution, not as a permanent map of every North Korean intrusion set.

As of the August 26, 2026 research cutoff, the FBI still lists Rim Jong Hyok as wanted for alleged computer-hacking and promotion-money-laundering conspiracies. A wanted notice and indictment establish the government's allegation and current law-enforcement posture; they do not establish guilt.

What Are Andariel's Objectives?

Strategic Espionage

The joint advisory says the RGB 3rd Bureau primarily targets defense, aerospace, nuclear, and engineering organizations to obtain sensitive technical information and intellectual property that could advance North Korea's military and nuclear programs. It describes an ongoing threat to sectors worldwide, including organizations in the United States, South Korea, Japan, and India.

Mandiant's history adds government, energy, nuclear research, financial services, agriculture, healthcare, and pharmaceutical research. These targets should not be flattened into a generic “critical infrastructure” label. The likely value differs: military designs, engineering processes, energy information, scientific research, operational access, or funds.

In February 2026, Google Threat Intelligence Group said it had directly observed APT45, APT43, and UNC2970 campaigns targeting people at defense organizations. It also identified a suspected APT45 operation using SMALLTIGER against reported South Korean defense, semiconductor, and automotive manufacturing targets. The GTIG defense-industrial-base report makes personnel and hiring workflows part of the current defensive picture.

Revenue and Ransomware

The U.S. government's 2024 assessment goes beyond saying that a North Korean actor used ransomware. It links the RGB 3rd Bureau activity discussed in the advisory with ransomware operations against U.S. healthcare entities that funded espionage. DOJ alleged that Rim Jong Hyok and co-conspirators used Maui ransomware to extort healthcare providers, laundered the proceeds, and used funds to lease infrastructure for later intrusions against defense, technology, and government targets.

Mandiant is more cautious for its APT45 cluster. It assesses with moderate confidence that APT45 engaged in ransomware development, while stating that it could not confirm APT45 attribution for every ransomware-related cluster in public reporting. Both positions can coexist because the sources use different scopes and evidence.

The distinction matters. “Andariel uses ransomware” is supportable when tied to the U.S. government's narrower unit-level assessment and allegations. “Every Maui or H0lyGh0st incident is APT45” is not. “APT45 is primarily a ransomware gang” is also inaccurate because strategic collection is central to its public history.

DeepStrike's North Korean cryptocurrency operations analysis owns the broader DPRK financial-theft topic. Andariel's public revenue evidence should not be merged with every Lazarus- or BlueNoroff-linked cryptocurrency case.

Disruption and Optionality

MITRE notes destructive activity in Andariel's historical record. Access to a strategically valuable network can also create options: quiet collection now, broader access later, or disruptive impact if objectives change. Defenders should therefore protect confidentiality, integrity, and availability rather than assuming that espionage produces no operational risk.

Who Does Andariel Target?

The target list is an exposure model, not a prediction. A company in one of these sectors is not necessarily being targeted, and an intrusion in the sector is not automatically Andariel. DeepStrike's overview of state-sponsored hacking and APT threats provides the wider comparison context.

How Andariel Operations Develop

No single chain represents every campaign. Public reporting supports a set of recurring defensive possibilities:

1. Target research and exposure discovery. Operators may identify internet-facing software, high-value organizations, projects, suppliers, or personnel.
2. Initial access. Reported paths include exploitation of known vulnerabilities in exposed applications and targeted phishing or professional lures.
3. Execution and foothold. Loaders, downloaders, web-access mechanisms, custom backdoors, or legitimate remote tools can establish continued access.
4. Discovery and credentials. The actor may enumerate hosts, processes, users, network connections, software, and sensitive resources, then seek reusable identity material.
5. Persistence and movement. Continued access can involve scheduled execution, remote services, proxies, credentials, or tools that resemble legitimate administration.
6. Collection. Espionage paths can gather local files, engineering data, research, intellectual property, or repository content.
7. Exfiltration or impact. A campaign may remove data, encrypt systems, extort a victim, or combine collection and disruption.
8. Infrastructure change or re-entry. Closing one malware alert may not remove compromised identities, exposed services, third-party paths, or alternate footholds.

Recent Microsoft reporting shows why attack-surface management matters: Onyx Sleet has exploited multiple already disclosed vulnerabilities in internet-facing products. The lesson is not to hunt only those five CVEs forever; it is to maintain ownership, exposure, patch, and telemetry coverage for every public-facing service.

Selected MITRE ATT&CK Techniques and Defensive Telemetry

MITRE's G0138 profile is a historical, source-aggregated knowledge base. It is not a checklist guaranteed to appear in a current intrusion, and technique overlap cannot establish attribution.

Publicly disclosed vulnerability exploitation also appears in Microsoft and joint-government reporting. Microsoft listed CVE-2021-44228, CVE-2023-46604, CVE-2023-22515, CVE-2023-27350, and CVE-2023-42793 among vulnerabilities used by Onyx Sleet in the observed period. Treat that list as evidence for exposure review, not as a permanent signature. A durable patch-management program must cover new exposed flaws, emergency decisions, compensating controls, and validation after remediation.

Malware and Tools Associated With Andariel-Related Reporting

Legitimate remote management, proxy, and system utilities can be used by administrators or attackers. DeepStrike's guide to living off the land explains why allowlisting a product name is weaker than baselining who launched it, from which parent process, on which device, under which identity, and toward which destination.

Static indicator lists decay quickly. They can support a time-bounded hunt, but this article intentionally does not republish IP addresses, domains, hashes, filenames, certificates, or wallet addresses. Defenders should retrieve current indicators from the original advisory or their trusted intelligence platform and retain the source date.

What the Ransomware Evidence Actually Shows

In July 2024, DOJ announced an indictment charging North Korean national Rim Jong Hyok with involvement in conspiracies to hack and extort U.S. hospitals, launder ransom proceeds, and fund additional intrusions. DOJ said the defendants were known in the private sector as Andariel, Onyx Sleet, and APT45, and alleged that Maui ransomware proceeds paid for infrastructure used against defense, technology, government, energy, and other targets. The DOJ Andariel case announcement also states plainly that an indictment is an allegation and defendants are presumed innocent unless proven guilty.

The legal announcement followed a 2022 investigation in which DOJ seized roughly half a million dollars connected to North Korean Maui ransomware and money laundering. Rapid reporting by a Kansas medical center helped investigators identify the then-new strain, trace payments, find another victim, seize funds, and support a joint advisory. The operational lesson is that timely reporting can create options beyond the victim's own recovery effort.

Mandiant's 2024 assessment uses a different evidentiary formulation: moderate confidence that APT45 engaged in ransomware development, but an inability to confirm APT45 attribution for every suspected ransomware cluster. Microsoft separately observed overlap between Onyx Sleet and Storm-0530, while saying H0lyGh0st ransomware use was unique to Storm-0530. Those distinctions should remain visible.

For healthcare leaders, the actor name should not eclipse patient-care risk. Segmentation, protected backups, recovery exercises, identity containment, downtime procedures, and law-enforcement contacts are more actionable than proving a vendor alias during the first hour. DeepStrike's current healthcare cybersecurity statistics can provide sector context without turning industry-wide figures into Andariel metrics.

The DeepStrike Andariel Mission-to-Telemetry Matrix

Use the matrix to move from public reporting to testable evidence. It is an original DeepStrike decision aid, not an attribution standard.

Two principles matter. First, early-stage behavior may not reveal the final mission, so preserve both espionage and impact evidence. Second, containment should address verified access before analysts debate sponsor attribution. The organization's own logs establish the incident; public intelligence frames hypotheses.

How to Detect Andariel-Related Behavior

Public-Facing Systems

Maintain a current inventory of exposed services, versions, owners, dependencies, and business criticality. Correlate exploitation detections with server process creation, new files, outbound connections, authentication, and changes to applications or access mechanisms. A vulnerability scan alone cannot show whether exploitation occurred.

Endpoint and Server Activity

Collect process creation, command-line, file, module-load, script, service, scheduled-task, security-control, and network telemetry. Alert on unusual execution chains and remote tooling in context not merely the presence of a utility that administrators also use.

Identity and Privileged Access

Centralize sign-ins, MFA events, token issuance and revocation, privileged-role changes, service-account use, remote access, and directory audit logs. Investigate sequences that connect a newly affected device or server to a high-value identity and a sensitive data source.

Network and Egress

Preserve DNS, proxy, firewall, NetFlow, VPN, remote-access, and segmentation logs for a retention period that supports long-dwell investigations. Look for first-seen destinations, unusual encrypted sessions, proxy behavior, unexpected cross-segment access, and volume changes around sensitive systems.

Sensitive Data and Developer Systems

Monitor repository clones, branch or workflow changes, package and artifact access, secrets, cloud storage, engineering file shares, and large archive creation. Defense and technology organizations should map crown-jewel projects to the identities, endpoints, suppliers, and services that can reach them.

Ransomware and Recovery Systems

Alert on mass file modification, backup policy changes, deletion or tampering, service interruption, unexpected hypervisor activity, and privileged access to recovery consoles. Recovery infrastructure needs separate credentials, restricted network paths, protected logs, and tested restore procedures.

An incident response plan should specify who can isolate a public server, revoke a privileged identity, protect evidence, pause sensitive operations, contact counsel, notify leadership, and engage government or specialist responders.

Mitigation Priorities

Organization-wide ransomware statistics can help explain business pressure, but they do not predict Andariel activity. Base control priorities on the organization's exposed services, sensitive data, critical operations, identity paths, and recovery dependencies.

Incident Response Checklist

1. Triage the behavior, not the brand. Record the initiating alert, affected asset, identity, time, and confirmed impact before assigning an actor.
2. Preserve volatile and protected evidence. Capture relevant endpoint, server, network, identity, cloud, repository, backup, and security-tool records according to the response plan.
3. Contain verified access. Restrict affected hosts, sessions, accounts, exposed services, and network paths while accounting for operational safety.
4. Review identity scope. Revoke sessions and rotate passwords, tokens, keys, service credentials, and application secrets that the evidence places at risk.
5. Hunt for alternate footholds. Examine related servers, remote tools, tasks, services, accounts, outbound infrastructure, and third-party paths.
6. Run collection and impact workstreams together. Determine whether sensitive data was accessed or removed even if encryption is the visible event.
7. Protect recovery. Confirm that clean backups, hypervisors, identity systems, and management consoles are separated from compromised credentials.
8. Coordinate obligations. Engage legal, privacy, regulatory, insurance, sector, and law-enforcement contacts according to jurisdiction and impact.
9. Validate eradication and restoration. Close the original exposure, remove persistence, rotate affected secrets, restore from trusted sources, and monitor for re-entry.
10. Record attribution confidence separately. Maintain distinct findings for incident facts, technical cluster fit, sponsor attribution, and legal status.

Do not delay urgent containment while trying to prove an Andariel attribution. The July 2024 case also illustrates the value of early reporting: the FBI's current cyber guidance directs victims to report online crime promptly because rapid reporting can support investigation and potential recovery.

Andariel Compared With Nearby DPRK Labels

This table is not a definitive organization chart. It is a writing and triage guardrail. DeepStrike's comparison of red teams and blue teams is also useful here: threat intelligence supplies hypotheses, defenders validate evidence, and authorized testing examines whether controls work without impersonating a real government's identity.

Common Misconceptions

Andariel is just another name for every Lazarus operation. Public sources place it within the broader Lazarus ecosystem, but MITRE and vendors also track it separately.

APT45 and Onyx Sleet are perfect synonyms. They substantially overlap in public reporting, yet their vendors define and update their clusters independently.

Andariel is primarily a ransomware gang. Strategic espionage is central to the group's public history. Ransomware is a documented or assessed additional mission, not the whole entity.

Mandiant's caution disproves the U.S. government's ransomware claim. The sources use different cluster scopes, intelligence, and confidence language. Preserve both rather than forcing a false contradiction.

One malware family or CVE proves attribution. Tools, vulnerabilities, and ATT&CK techniques are shared across actors and legitimate administrators. Attribution needs a broader evidence set.

Old IOCs provide durable detection. Infrastructure and files change. Behavior, identity, exposure, process lineage, data access, and source-dated intelligence are more resilient.

Espionage is less urgent because it does not encrypt systems. Theft of military, engineering, nuclear, research, or source-code data can create strategic, contractual, safety, and downstream risks.

A penetration test can certify an organization as Andariel-proof. Testing evaluates a defined scope and time. It cannot guarantee resistance to a changing state-sponsored actor.

Frequently Asked Questions

What is Andariel?

Andariel is a North Korean state-sponsored cyber threat group associated with the Reconnaissance General Bureau. MITRE tracks it as G0138, says it has operated since at least 2009, and considers it a subset of Lazarus Group. Public reporting connects it to espionage, destructive activity, cyber-enabled revenue, and ransomware-related operations.

Is Andariel the same as Lazarus Group?

Not exactly. U.S. Treasury and MITRE describe Andariel as a Lazarus subgroup or subset, while vendors often track its activity as a distinguishable cluster. “Lazarus Group” is also used as a broad umbrella, so an incident attributed to Lazarus should not automatically be relabeled Andariel.

Are APT45 and Onyx Sleet aliases for Andariel?

Mandiant's APT45 and Microsoft's Onyx Sleet substantially overlap with activity reported as Andariel. The July 2024 joint advisory warns that vendor groupings may not match the U.S. government's scope 1:1. Use the source's original label and confidence instead of treating every alias as universally interchangeable.

Does Andariel use ransomware?

U.S. authorities connect an Andariel unit to Maui ransomware attacks against healthcare organizations and allege that proceeds funded later espionage infrastructure. Mandiant assesses APT45 ransomware development with moderate confidence but does not confirm every suspected cluster. Andariel should therefore be described as an espionage actor with documented or assessed ransomware activity, not simply as a ransomware gang.

What sectors does Andariel target?

The strongest public reporting emphasizes defense, aerospace, nuclear, engineering, government, technology, energy, and healthcare. Other observed targets include manufacturing, construction, education, agriculture, pharmaceutical research, financial services, and selected online businesses. Sector similarity supports prioritization, not attribution by itself.

What malware does Andariel use?

Public reporting associates Andariel-related clusters with Dtrack, TigerRAT, SmallTiger, LightHand, ValidAlpha, Dora RAT, Maui, and other custom tools, plus open-source and legitimate utilities. Tool presence alone does not prove the actor because malware can be shared, copied, repurposed, or misclassified.

Is Andariel still active in 2026?

Current public reporting supports continued relevance. In February 2026, GTIG said it had directly observed APT45 campaigns targeting people in defense organizations and identified a suspected APT45 SMALLTIGER operation. MITRE then modified the Andariel G0138 profile on July 31, 2026. These are dated observations, not a guarantee about every current campaign.

Conclusion

Andariel matters because its public record crosses boundaries that defenders often separate: strategic espionage and revenue, custom malware and legitimate tools, exposed services and targeted people, quiet collection and disruptive impact. Its labels also demonstrate why attribution must retain the source, date, scope, and confidence.

The durable defensive program is broader than an IOC list. Own and patch exposed systems, protect high-value identities and engineering data, govern remote tools, centralize endpoint and network telemetry, isolate recovery infrastructure, and rehearse a response that can investigate both exfiltration and encryption.

Where those risks match an organization's threat model, DeepStrike's penetration testing services can validate scoped internet-facing, internal, identity, cloud, and segmentation paths under written authorization and support remediation verification. The result is evidence about the tested scope and time not certification against Andariel or any named actor.

Author and Review Information

Author: Mohammed Khalil, CISSP, OSCP, OSWE

Last reviewed: August 26, 2026

Research verified through: August 26, 2026

Threat-actor naming, legal status, indicators, and active campaigns can change. Recheck the primary sources immediately before publication and before any material update.