BlueNoroff
MITRE G0138Also known as STARDUST CHOLLIMA, Sapphire Sleet, UNC1069, Stardust Chollima, SapphireSleet, APT38, ClickFake Interview, Alluring Pisces, CageyChameleon, CryptoCore, TA444, COPERNICIUM
Reports
16
First seen
Jun 18, 2025
Last seen
Oct 8, 2026
Motivation
Financial, Espionage
Relationships
Filled ◆ = CVE exploited in the wild. Entities that appear together in Signalis reporting — co-mention, not confirmed collaboration. Reports naming many actors at once (weekly roundups) are excluded from relationship edges.
Targeting
Victim regions
×1×1
Japan×1
United States×1
Victim country, only when stated. Corpus is predominantly English-language reporting, so US/EU coverage is overweighted relative to true victim distribution.
Top ATT&CK techniques
T1566 Phishing ×7T1195 Supply Chain Compromise ×6T1195.001 Supply Chain Compromise: Compromise Software Dependencies ×6T1071.001 Web Protocols ×5T1041 Exfiltration Over C2 Channel ×5T1547 Boot or Logon Autostart Execution ×5T1566.002 Phishing: Spearphishing Link ×5T1555 Credentials from Password Stores ×4T1059.001 PowerShell ×4T1082 System Information Discovery ×4T1204 User Execution ×4T1078 Valid Accounts ×4
Indicators
filename ×16hash_sha256 ×15domain ×13url ×6cve ×4ip_v4 ×3hash_sha1 ×3hash_md5 ×2email ×2registry_key ×1
Indicator values are available on Pro and via the API.
Associated CVEs
Recent reports
unrated