North Korean threat actors
Reports
3
First seen
Oct 2, 2025
Last seen
Jul 29, 2026
Motivation
Espionage, Financial
Relationships
Filled ◆ = CVE exploited in the wild. Entities that appear together in Signalis reporting — co-mention, not confirmed collaboration. Reports naming many actors at once (weekly roundups) are excluded from relationship edges.
Targeting
Sectors
Top ATT&CK techniques
T1041 Exfiltration Over C2 Channel ×2T1566 Phishing ×2T1040 Network Sniffing ×1T1105 Ingress Tool Transfer ×1T1027 Obfuscated Files or Information ×1T1003 OS Credential Dumping ×1T1204 User Execution ×1T1047 Windows Management Instrumentation ×1T1115 Clipboard Data ×1T1071.001 Application Layer Protocol - Web Protocols ×1T1190 Exploit Public-Facing Application ×1T1555 Credentials from Password Stores ×1
Indicators
cve ×56domain ×5filename ×1ip_v4 ×1
Indicator values are available on Pro and via the API.
Associated CVEs
Recent reports
Critical