BlueNoroff
☆ pinMITRE G0133Also known as STARDUST CHOLLIMA, UNC1069, Sapphire Sleet, TA444, COPERNICIUM, CageyChameleon
Reports
7
First seen
Jun 18, 2025
Last seen
Jun 20, 2026
Motivation
Financial gain, cryptocurrency theft, Financial gain, Supply-chain compromise, financial gain
Targeting
Sectors
Technology ×6Financial Services ×1
Victim regions
United States ×1
Top ATT&CK techniques
T1195 Supply Chain Compromise ×4T1547 Boot or Logon Autostart Execution ×4T1566 Phishing ×3T1204 User Execution ×2T1056 Input Capture ×2T1110 Brute Force ×2T1078 Valid Accounts ×2T1021 Remote Services ×2T1547.001 Registry Run Keys / Startup Folder ×2T1041 Exfiltration Over C2 Channel ×2T1003 OS Credential Dumping ×2T1082 System Information Discovery ×2
Indicators
hash_sha256 ×15domain ×10filename ×9url ×6hash_sha1 ×3hash_md5 ×2ip_v4 ×2email ×2registry_key ×1
Indicator values are available on Pro and via the API.
Recent reports
High