Andariel / APT45

Overview

Andariel / APT45 is the North Korean state's dedicated military technology acquisition unit — an organization whose operational purpose is to supply the technical intelligence needed to advance North Korea's weapons programs by stealing it from the organizations that developed it. While APT38 / BeagleBoyz is tasked with generating revenue through financial theft, and APT37 / ScarCruft is tasked with domestic political surveillance, Andariel's mission is framed by Mandiant in explicitly military terms: it answers Kim Jong Un's requirement for better missiles, better tanks, better radar systems, better anti-aircraft weapons — by stealing the blueprints, specifications, engineering documents, and design drawings from the institutions that built them.

The group has been operational since at least 2009, making it one of North Korea's oldest continuously operating cyber units. Its early work consisted of destructive attacks against South Korean organizations and classic espionage against government and defense targets. Over more than fifteen years, it has evolved through multiple phases — expanding from South Korean targets to US, Japanese, and Indian defense and nuclear facilities, adding a financially motivated ransomware component to fund its espionage operations, and most recently targeting healthcare and crop science sectors in ways that reflect the DPRK's own domestic priorities.

Mandiant's elevation of Andariel to APT45 status in July 2024 coincided with a coordinated advisory from the FBI, CISA, NSA, US Cyber Command, the UK's NCSC, and allied agencies — explicitly documenting the group's focus on stealing nuclear technology, anti-aircraft specifications, missile system data, and broader military intellectual property. The same week, the DOJ indicted Rim Jong Hyok for the Maui ransomware healthcare attacks — the operation by which Andariel funds its espionage activities. The combination of simultaneous espionage and ransomware missions on the same infrastructure, against the same victims, in the same day, is documented in the CISA advisory as a confirmed operational pattern.

The Espionage Mission: What Andariel Steals

The CISA/FBI/NSA July 2024 joint advisory provided the most detailed public accounting of Andariel's actual intelligence collection requirements — the categories of technical information Pyongyang has specifically tasked the group to acquire.

• Contract specifications and bills of materials for defense systems — the detailed component lists and engineering specifications for weapons platforms, covering both what a system is made of and how those components interact.
• Project details and design drawings — engineering drawings, CAD files, technical specifications, and design documentation for military equipment including heavy and light tanks, self-propelled howitzers, light strike vehicles, ammunition supply vehicles, infantry fighting vehicles, and associated systems.
• Missile and missile defense systems — technical data on missile guidance systems, propulsion, warheads, and counter-missile platforms, including radar system specifications relevant to missile defense.
• Nuclear program data — information stored in government nuclear research facilities and nuclear power plants, including uranium processing and enrichment data, nuclear power plant configurations, and nuclear weapons research documentation. The Dtrack backdoor's deployment at India's Kudankulam Nuclear Power Plant in 2019 is the documented operational example — one of the few confirmed instances of North Korean operators accessing nuclear power plant infrastructure.
• Drone and autonomous system specifications — technical data on unmanned aerial vehicles, their guidance systems, and drone defense technologies.
• Anti-aircraft weapon systems — the Seoul Metropolitan Police specifically attributed theft of anti-aircraft weapon system specifications from South Korean companies to APT45 in December 2023.
• Healthcare and pharmaceutical research — Mandiant notes that Andariel continued targeting healthcare and pharmaceutical companies after other DPRK groups pivoted away, suggesting an ongoing mandate. This may reflect collection requirements for North Korea's domestic health system or for understanding vaccine and treatment technologies relevant to the country's isolated population.
• Crop science research — the 2020 targeting of a multinational corporation's crop science division is assessed as related to North Korea's agricultural crisis, suggesting Andariel's collection requirements extend to any technology that addresses the regime's domestic vulnerabilities.

The specific intelligence value of these targets is direct and immediate: North Korea's weapons programs do not develop in isolation. Every missile test, every artillery system, every nuclear advance draws on technical data acquired by units like Andariel from the countries it targets. The Mandiant assessment that "many advances in North Korea's military capabilities in recent years can directly be attributed to APT45's successful espionage efforts" is a statement with specific geopolitical weight — these are not hypothetical future threats but documented contributions to the DPRK's existing weapons capability.

Ransomware as Operational Funding

Andariel's model of using ransomware attacks against US healthcare providers to fund its espionage infrastructure represents a distinct operational structure unique among documented APT groups — a state-sponsored espionage unit self-financing its operations through cybercrime against civilian medical institutions.

• The Mechanism: Andariel operators compromise US healthcare organizations using Log4Shell (CVE-2021-44228) and similar vulnerabilities to gain initial access, deploy Maui ransomware to encrypt systems used for medical testing, electronic records, and patient care, and demand Bitcoin ransom payments. The encrypted hospital systems prevent patients from receiving timely care — a documented patient safety consequence explicitly acknowledged in the DOJ's characterization of the Rim Jong Hyok indictment. When victims pay, the cryptocurrency is laundered through Hong Kong-based facilitators, converted to Chinese yuan, and withdrawn from ATMs in China near the Sino-Korean Friendship Bridge between Dandong and Sinuiju — a laundering route that physically crosses the border into North Korea. The resulting funds purchase VPS infrastructure used in subsequent defense sector espionage operations.
• Scale: The Rim Jong Hyok indictment documented Andariel targeting five US healthcare providers, four US defense contractors, two US Air Force bases, and NASA's Office of Inspector General — all using infrastructure purchased with hospital ransom proceeds. In a single documented case, a November 2022 cyber attack on a US defense contractor resulted in the exfiltration of more than 30 gigabytes of technical data. The ransomware and espionage infrastructure were directly connected: the VPS servers bought with ransom payments hosted the C2 infrastructure for the defense contractor intrusions.
• Maui Ransomware: Maui is a ransomware strain that Andariel operators manually execute on victim systems rather than deploying as a self-propagating worm — requiring an active operator presence in the victim network. CISA first documented Maui in a July 2022 advisory after multiple healthcare providers were attacked. Maui encrypts targeted files using AES-128, RSA-2048, and XOR encryption. Unlike criminal ransomware that broadcasts ransom demands, Maui targets specific files identified by operators during the manual execution phase, reflecting the operator's prior knowledge of the victim's network from the initial Log4Shell intrusion phase.
• Simultaneous Operations: CISA's advisory explicitly documented that Andariel has launched ransomware attacks and conducted cyber espionage operations on the same day against the same entity — using the same compromised infrastructure for both ransom extortion and technical data exfiltration. This blurring of criminal and espionage activity within a single operation represents an unusual organizational model that creates specific legal and attribution challenges for responding agencies.

Known Campaigns

Tactics, Techniques & Procedures

mitre id	technique	description
T1190	Exploit Public-Facing Application — Log4Shell	The documented primary initial access technique in Andariel's dual ransomware-espionage operations is exploitation of CVE-2021-44228 (Log4Shell) — a critical remote code execution vulnerability in the widely-used Apache Log4j logging library. CISA's advisory and the Rim Jong Hyok indictment both specifically cite Log4Shell as the initial access vector for hospital and defense contractor intrusions. From late 2021 through 2023, Andariel used Log4Shell to compromise web servers, deploy web shells for persistent access, and then pivot into internal networks for both ransomware deployment and technical data exfiltration. The vulnerability's prevalence — Log4j is embedded in countless enterprise Java applications — gave Andariel broad access to targets across healthcare, defense, and government sectors from a single exploit.
T1505.003	Web Shell — Post-Exploitation Persistence	After gaining initial access via Log4Shell or other public-facing application exploitation, Andariel deploys web shells to maintain persistent access to compromised servers. The web shell provides a stable reentry point to the victim's network that persists even if the initial Log4Shell-exploited application is patched. CISA documented that Andariel deploys web shells specifically to "gain access to sensitive information and applications for further exploitation" — using the web shell as both a persistence mechanism and a staging point for lateral movement toward the internal network segments containing the target data.
T1003	Credential Dumping — Mimikatz and Common Tools	After establishing web shell access, Andariel escalates privileges and moves laterally using common credential dumping tools including Mimikatz. CISA's advisory documents this as part of the standard post-exploitation pattern: initial access via Log4Shell, web shell deployment, then privilege escalation via credential dumping tools to obtain domain administrator credentials, followed by lateral movement to reach both the data targeted for espionage exfiltration and the systems targeted for ransomware encryption. The use of commodity tools like Mimikatz alongside custom malware like Maui and Dtrack reflects a mixed toolkit approach where off-the-shelf tools handle standard intrusion tasks and custom tools handle the specialized missions.
T1486	Data Encrypted for Impact — Maui Ransomware	Maui ransomware is deployed via manual operator execution after establishing network access — distinguishing it from self-propagating criminal ransomware. Operators identify and specifically target files used for medical testing systems and electronic health records before executing Maui's encryption. The manual deployment approach means operators have already mapped the victim's network and identified the highest-value files for encryption before the ransom demand is created. Maui uses a combination of AES-128, RSA-2048, and XOR encryption. Unlike criminal ransomware with automated propagation, each Maui deployment is an active operator decision — reflecting the espionage-style operational patience characteristic of Andariel's culture.
T1041	Exfiltration — Defense Technical Data Collection	The espionage mission executes data exfiltration of technical documents including contract specifications, bills of materials, design drawings, engineering documents, and project details from defense and nuclear organizations. The CISA advisory documents that the information collected "has military and civilian applications" and directly contributes to DPRK's weapons programs. A single documented November 2022 defense contractor intrusion resulted in over 30 gigabytes of data exfiltration. Data is exfiltrated through VPS servers purchased with ransomware proceeds — creating a direct financial link between the healthcare ransomware operations and the defense espionage infrastructure.
T1027	Obfuscated Files — Custom Encoding and Code Reuse	Andariel malware exhibits a distinct genealogy of code reuse, custom encoding, and unique passwords across tool families — a pattern Mandiant uses as a key attribution indicator to distinguish APT45 from other DPRK-nexus groups. Microsoft's advisory on Onyx Sleet documents the group as "constantly evolving its toolset to add new functionality and implement novel ways to bypass detection" while maintaining a "fairly uniform attack pattern." The combination of evolving detection evasion with stable underlying attack patterns creates a recognizable operational fingerprint despite ongoing tool updates.
T1583.003	Acquire Infrastructure — Ransom-Funded VPS Procurement	The documented financial model: hospital ransom proceeds are laundered through Hong Kong facilitators, converted to yuan, and withdrawn from ATMs near the Sino-Korean Friendship Bridge. The resulting funds purchase virtual private servers that serve as C2 infrastructure for subsequent defense sector espionage operations. This creates a traceable financial chain — from hospital Bitcoin payment to VPS server purchase to Air Force base intrusion — that the DOJ and FBI specifically documented in the Rim Jong Hyok indictment and that gave investigators the evidentiary thread connecting the ransomware operations to the defense espionage campaigns.

DOJ Indictment — Rim Jong Hyok

On July 25, 2024, a grand jury in Kansas City, Kansas returned an indictment against Rim Jong Hyok, a North Korean national and Andariel unit member, for his role in the conspiracy to hack US hospitals, extort ransoms, launder the proceeds, and use those proceeds to fund espionage operations against US government and defense targets.

• Charges and sentencing exposure: Conspiracy to commit computer hacking (maximum 5 years) and conspiracy to commit money laundering (maximum 20 years) — a combined maximum exposure of 25 years. The indictment specifically frames the ransomware extortion and the downstream espionage as a single conspiracy with two operational phases rather than two separate criminal activities.
• Documented victims — 17 total: Five US healthcare providers (including a Kansas hospital, and providers in Arkansas, Florida, Colorado, and Connecticut), four US defense contractors, two US Air Force bases (Randolph Air Force Base, Texas and Robbins Air Force Base, Georgia), and NASA's Office of Inspector General. Total: 17 identified victims across 11 US states plus additional entities in Taiwan, South Korea, and China.
• NASA intrusion specifics: Rim and co-conspirators had access to NASA's computer systems for more than three months, extracting over 17 gigabytes of unclassified data during that period. The NASA-OIG's own Cyber Crimes Division contributed forensic analysis to the investigation.
• The laundering chain: Rim and co-conspirators laundered ransom payments through Hong Kong-based facilitators who converted cryptocurrency to Chinese yuan. The yuan was then accessed from ATMs in China in the immediate vicinity of the Sino-Korean Friendship Bridge — a laundering route that the indictment describes as leaving a physical trail within meters of the North Korean border. In at least one case, laundered funds were used to purchase VPS servers that were then used to exfiltrate data from defense contractor networks.
• Status and reward: Rim Jong Hyok is not in US custody. A federal arrest warrant has been issued. The State Department's Rewards for Justice program offers up to $10 million for information leading to his identification or location — the same reward level offered for Bybit hacker attribution and APT38 defendants.
• Context — Song Kum Hyok (2025): In 2025, US Treasury sanctioned Song Kum Hyok, a 38-year-old North Korean national based in China's Jilin province, for involvement in both the APT45 organization and in North Korea's fraudulent IT worker scheme — connecting Andariel's technical operations to the DPRK's broader revenue-generation infrastructure of placing fake IT workers in Western companies.

Tools & Malware

• Dtrack (Valefor / Preft): A persistent backdoor that is Andariel's most documented custom espionage tool. Dtrack provides remote access, keylogging, screenshot capture, file system enumeration, and command execution. It was first publicly identified through its deployment at the Kudankulam Nuclear Power Plant in 2019. Dtrack is strongly associated with APT45 attribution — it forms part of the distinct malware genealogy that separates Andariel's toolkit from other North Korean groups. The backdoor has appeared across defense, nuclear, and research sector intrusions over multiple years.
• Maui Ransomware: Operator-executed ransomware used specifically against US healthcare providers to generate ransom proceeds. Maui uses AES-128, RSA-2048, and XOR encryption to encrypt victim files. It is deployed manually by operators who have already mapped the victim network — a characteristic that distinguishes it from criminal ransomware with automated propagation. CISA first documented Maui in a July 2022 advisory. Unlike most ransomware, Maui does not broadcast ransom demands automatically — operators manually communicate ransom demands to victims after deployment.
• SHATTEREDGLASS: A ransomware family documented by Kaspersky in June 2021, linked by Mandiant to suspected APT45 clusters. SHATTEREDGLASS has been used against entities in South Korea, Japan, and the US — predating the Maui ransomware campaign and suggesting Andariel's ransomware development began before the more widely documented Maui operations.
• TigerRAT: A backdoor used for information theft and command execution, including keylogging and screen recording from C2 server direction. Documented by Microsoft in its Onyx Sleet analysis as part of the group's core toolset alongside Dtrack.
• ValidAlpha (Black RAT): A Go-based backdoor capable of running arbitrary files, listing directory contents, downloading files, taking screenshots, and launching shell access for arbitrary command execution. Documented by Microsoft alongside TigerRAT as part of the Onyx Sleet toolkit.
• 3PROXY: A publicly available proxy tool used in APT45 operations for tunneling traffic through compromised systems — consistent with Mandiant's documentation of the group using a mix of public tools, modified tools, and custom malware.
• ROGUEEYE: A backdoor based on modified publicly available malware, documented by Mandiant as part of APT45's arsenal. The modification-of-public-tools approach appears consistently across APT45's toolkit alongside fully custom tools like Dtrack.
• Web Shells: Post-exploitation web shells deployed after initial Log4Shell access, providing persistent access to compromised servers. Used as staging points for lateral movement into internal network segments.

Indicators of Compromise

IOCs from CISA joint advisory AA24-207A (July 2024), the Rim Jong Hyok DOJ indictment, CISA Maui ransomware advisory (2022), Microsoft Onyx Sleet advisory, and Mandiant APT45 research. The CISA advisory includes a VirusTotal collection of APT45-related indicators. Full IOC tables including file hashes, domains, and IP addresses are in the advisories linked in Sources.

Mitigation & Defense

Andariel's dual-mission model creates two distinct defensive contexts with different urgencies: healthcare organizations face ransomware that disrupts patient care, while defense, aerospace, nuclear, and engineering organizations face technical data theft that contributes to weapons program advancement. Both require active defensive measures.

• Patch Log4j Completely — Everywhere: The Log4Shell vulnerability (CVE-2021-44228) is Andariel's documented primary initial access vector across both its healthcare ransomware and defense espionage operations. Three years after the vulnerability's disclosure, unpatched Log4j instances remain in enterprise environments embedded in third-party applications, legacy systems, and vendor software where direct patching is not straightforward. Conduct a comprehensive Log4j asset inventory using available scanning tools — not just searching for obvious Log4j jar files but examining all Java applications and container images for any version of Log4j in their dependency chain. Unpatched Log4j on any internet-facing system is a confirmed Andariel access vector that must be remediated or isolated.
• Healthcare Sector — Maui Ransomware Detection: Maui is operator-executed rather than auto-propagating, meaning it appears on victim systems only after an operator has already achieved network access and mapped the environment. Detection must occur before Maui execution — not by detecting Maui itself but by detecting the precursor compromise indicators: web shell deployment on Log4j-vulnerable servers, credential dumping with Mimikatz, and lateral movement toward systems hosting medical testing and EHR data. CISA's Maui advisory (2022) provides specific detection signatures. Any healthcare organization that identifies Log4j exploitation on their web servers should treat this as a potential Andariel intrusion requiring immediate incident response rather than a standalone vulnerability patching event.
• Defense and Nuclear Sector — Technical Data Protection: Andariel's specific collection requirements — contract specifications, design drawings, bills of materials, engineering documents — are well-documented. Implement data loss prevention controls specifically tuned to detect bulk access or exfiltration of these document types from engineering and project management systems. Apply need-to-know access controls to sensitive technical documents — users should not have access to specifications for weapons systems they are not currently working on. Network segmentation between general corporate IT and engineering workstations that hold classified or sensitive technical data limits lateral movement toward the target documents even after initial access is achieved.
• Segment Nuclear Infrastructure from IT Networks: The Kudankulam Nuclear Power Plant compromise occurred via the administrative network — not the plant control network — but still gave Andariel access to infrastructure documentation. Nuclear facilities and other critical infrastructure organizations should maintain hard network segmentation between administrative/corporate IT networks and operational technology networks, with no direct connectivity. Any data transfer between IT and OT environments should require explicit authorization and monitoring.
• Post-Compromise Detection for Long-Dwell Espionage: Andariel's espionage operations involve extended network presence for data collection and exfiltration — not a quick ransomware-and-exit pattern. Proactive threat hunting in defense and nuclear sector networks, specifically looking for Dtrack backdoor indicators, unusual outbound connections from workstations handling sensitive technical documents, and anomalous authentication patterns on engineering data repositories, can detect Andariel intrusions before the exfiltration phase completes. Engagement with sector-specific ISACs (Defense-ISAC, Nuclear Energy ISAC) for sharing of Andariel-specific indicators is a recommended practice in the CISA advisory.

Sources & Further Reading

Attribution and references used to build this profile.

• CISA/FBI/NSA/DC3/NCSC — North Korea Cyber Group Conducts Global Espionage Campaign (July 2024, foundational advisory)
• Mandiant / Google Cloud — APT45: North Korea's Digital Military Machine (July 25, 2024)
• US Department of Justice — North Korean Government Hacker Charged for Ransomware Attacks Targeting US Hospitals (July 2024)
• CISA — North Korean State-Sponsored Cyber Actors Use Maui Ransomware to Target Healthcare Sector (July 2022)
• NASA OIG — NASA Cybercrime Sleuths Aid Investigation to Expose North Korean Ransomware Scheme
• Recorded Future News — North Korean Hacking Group Targeted Weapons Blueprints, Nuclear Facilities (July 2024)
• MITRE ATT&CK — Group G0138: Andariel