aol.pm

APT38

IntrusionSet · ATTACK:enterprise:G0082

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance
{
  "id": "ATTACK:enterprise:G0082",
  "title": "APT38",
  "type": "IntrusionSet",
  "source_url": "https://attack.mitre.org/groups/G0082",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "intrusion-set--00f67a77-86a4-4adf-be26-1a54fc713340",
  "external_id": "G0082",
  "domain": "enterprise",
  "created": "2019-01-29T21:27:24.793Z",
  "modified": "2026-10-09T03:56:03.463Z",
  "version": "4.0",
  "aliases": [
    "APT38",
    "NICKEL GLADSTONE",
    "BeagleBoyz",
    "Bluenoroff",
    "Stardust Chollima",
    "Sapphire Sleet",
    "COPERNICIUM"
  ],
  "tactics": [

  ],
  "source_references": [
    {
      "source_name": "BeagleBoyz"
    },
    {
      "source_name": "Stardust Chollima"
    },
    {
      "source_name": "APT38"
    },
    {
      "source_name": "Bluenoroff"
    },
    {
      "source_name": "Sapphire Sleet"
    },
    {
      "source_name": "COPERNICIUM"
    },
    {
      "source_name": "NICKEL GLADSTONE"
    },
    {
      "source_name": "CrowdStrike GTR 2021 June 2021",
      "url": "https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2021GTR.pdf"
    },
    {
      "source_name": "DOJ North Korea Indictment Feb 2021",
      "url": "https://www.justice.gov/opa/pr/three-north-korean-military-hackers-indicted-wide-ranging-scheme-commit-cyberattacks-and"
    },
    {
      "source_name": "CISA AA20-239A BeagleBoyz August 2020",
      "url": "https://us-cert.cisa.gov/ncas/alerts/aa20-239a"
    },
    {
      "source_name": "FireEye APT38 Oct 2018",
      "url": "https://services.google.com/fh/files/misc/apt38-un-usual-suspects.pdf"
    },
    {
      "source_name": "Kaspersky Lazarus Under The Hood Blog 2017",
      "url": "https://securelist.com/lazarus-under-the-hood/77908/"
    },
    {
      "source_name": "CrowdStrike Stardust Chollima Profile April 2018",
      "url": "https://www.crowdstrike.com/blog/meet-crowdstrikes-adversary-of-the-month-for-april-stardust-chollima/"
    },
    {
      "source_name": "Microsoft Threat Actor Naming July 2023",
      "url": "https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide"
    },
    {
      "source_name": "Microsoft Axios Compromise APR 2026",
      "url": "https://www.microsoft.com/en-us/security/blog/2026/04/01/mitigating-the-axios-npm-supply-chain-compromise/"
    },
    {
      "source_name": "Microsoft Sapphire Sleet APR 2026",
      "url": "https://www.microsoft.com/en-us/security/blog/2026/04/16/dissecting-sapphire-sleets-macos-intrusion-from-lure-to-compromise/"
    },
    {
      "source_name": "MIcrosoft Mastra npm Compromise JUN 2026",
      "url": "https://www.microsoft.com/en-us/security/blog/2026/06/17/postinstall-payload-inside-mastra-npm-supply-chain-compromise/"
    },
    {
      "source_name": "SecureWorks NICKEL GLADSTONE profile Sept 2021",
      "url": "https://www.secureworks.com/research/threat-profiles/nickel-gladstone"
    }
  ]
}

Explicit source assertions (121)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:G0082 → uses → ATTACK:enterprise:T1486

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--02e23a00-846a-4b86-9146-4a7354c23667

FireEye APT38 Oct 2018

ATTACK:enterprise:G0082 → uses → ATTACK:enterprise:T1055

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0321e766-10c1-4215-9fd6-7f712b642dca

Microsoft Axios Compromise APR 2026 · 1 - appv

ATTACK:enterprise:G0082 → uses → ATTACK:enterprise:T1033

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--064cfeb5-9ddb-4dd2-ada4-cf9e65601dc5

CISA AA20-239A BeagleBoyz August 2020 · Microsoft Sapphire Sleet APR 2026 · MIcrosoft Mastra npm Compromise JUN 2026

ATTACK:enterprise:G0082 → uses → ATTACK:enterprise:T1657

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--082485ea-c90a-49c6-af4a-fbb5e5b96757

Microsoft CYBERWARCON NOV 2024

ATTACK:enterprise:G0082 → uses → ATTACK:enterprise:T1112

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0ccca05d-955c-40fa-9fd4-c10480abcf3d

FireEye APT38 Oct 2018

ATTACK:enterprise:G0082 → uses → ATTACK:enterprise:T1036.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0d6bcabd-39bd-458b-8efc-5d409d9c2339

Microsoft Axios Compromise APR 2026 · Microsoft Sapphire Sleet APR 2026 · MIcrosoft Mastra npm Compromise JUN 2026

ATTACK:enterprise:G0082 → uses → ATTACK:enterprise:T1677

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0df39903-1a20-4f9d-ba60-503a1639adce

Microsoft Axios Compromise APR 2026 · MIcrosoft Mastra npm Compromise JUN 2026

ATTACK:enterprise:G0082 → uses → ATTACK:enterprise:S0593

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--10a5f6e2-9527-419a-b2f4-29087e05cf2d

CISA AA20-239A BeagleBoyz August 2020

ATTACK:enterprise:G0082 → uses → ATTACK:enterprise:T1049

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--11ab80ae-29e7-45a4-8d92-53493e2971c3

FireEye APT38 Oct 2018

ATTACK:enterprise:G0082 → uses → ATTACK:enterprise:T1070.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--161225df-de21-4715-b4f3-c324c05ff590

CISA AA20-239A BeagleBoyz August 2020 · FireEye APT38 Oct 2018 · Microsoft Axios Compromise APR 2026 · Microsoft Sapphire Sleet APR 2026

ATTACK:enterprise:G0082 → uses → ATTACK:enterprise:T1036.006

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--16f6d32e-72e5-4fcf-b3fa-1c108f027850

1 - appv

ATTACK:enterprise:G0082 → uses → ATTACK:enterprise:T1608.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1997b1ee-3028-4871-8f78-b55a840e5809

MIcrosoft Mastra npm Compromise JUN 2026

ATTACK:enterprise:G0082 → uses → ATTACK:enterprise:T1056.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1a49c7e5-32b0-4393-a464-1491b1ebc279

FireEye APT38 Oct 2018

ATTACK:enterprise:G0082 → uses → ATTACK:enterprise:T1056.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1ad3d8aa-34af-464a-9033-f8d022f8f2f9

MIcrosoft Mastra npm Compromise JUN 2026

ATTACK:enterprise:G0082 → uses → ATTACK:enterprise:T1518.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1c327eb2-e0af-45c2-a9ea-784252ad34b0

CISA AA20-239A BeagleBoyz August 2020 · MIcrosoft Mastra npm Compromise JUN 2026 · 1 - appv

ATTACK:enterprise:G0082 → uses → ATTACK:enterprise:S0039

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1f0832ca-30f2-4f5a-8e92-1d15222fc087

FireEye APT38 Oct 2018

ATTACK:enterprise:G0082 → uses → ATTACK:enterprise:T1543.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2012985d-6529-4944-a2d2-892d56751b94

CISA AA20-239A BeagleBoyz August 2020 · MIcrosoft Mastra npm Compromise JUN 2026

ATTACK:enterprise:G0082 → uses → ATTACK:enterprise:T1564.011

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--214acc16-c60b-493e-8309-ab69f03de175

Microsoft Axios Compromise APR 2026

ATTACK:enterprise:G0082 → uses → ATTACK:enterprise:T1213.006

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--21d98f1d-9d9f-446d-9437-ead5a148bff7

Microsoft Sapphire Sleet APR 2026

ATTACK:enterprise:G0082 → uses → ATTACK:enterprise:T1548.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--25654cd1-d99b-48c4-b891-8848b923d5f1

1 - appv

ATTACK:enterprise:G0082 → uses → ATTACK:enterprise:T1678

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--28c7f7cf-1490-4f78-9d5b-a26fd86198a1

MIcrosoft Mastra npm Compromise JUN 2026

ATTACK:enterprise:G0082 → uses → ATTACK:enterprise:T1189

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2d27c0d9-7e8e-4713-b3e1-0d82db27ac9a

CISA AA20-239A BeagleBoyz August 2020 · FireEye APT38 Oct 2018

ATTACK:enterprise:G0082 → uses → ATTACK:enterprise:T1683.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2d587d9a-e139-4a55-863e-19ae07d4ee09

Microsoft CYBERWARCON NOV 2024

ATTACK:enterprise:G0082 → uses → ATTACK:enterprise:T1053.006

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2eb4f9b7-7b13-4b26-bcbd-ffe931e4bbbc

MIcrosoft Mastra npm Compromise JUN 2026

ATTACK:enterprise:G0082 → uses → ATTACK:enterprise:T1083

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2f19f736-a547-47c3-ae26-40a0d13cdf41

CISA AA20-239A BeagleBoyz August 2020 · Microsoft Axios Compromise APR 2026 · Microsoft Sapphire Sleet APR 2026

ATTACK:enterprise:G0082 → uses → ATTACK:enterprise:T1213.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--330756e3-8bb1-4002-8626-1feef655ba8d

Microsoft Sapphire Sleet APR 2026

ATTACK:enterprise:G0082 → uses → ATTACK:enterprise:T1070.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--355060ad-0dfe-441f-ac72-d0b722e23c33

MIcrosoft Mastra npm Compromise JUN 2026

ATTACK:enterprise:G0082 → uses → ATTACK:enterprise:T1059.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3ab4c52a-aa3d-4c65-bd68-6614a0fb7bfe

FireEye APT38 Oct 2018 · Microsoft Axios Compromise APR 2026 · MIcrosoft Mastra npm Compromise JUN 2026 · 1 - appv

ATTACK:enterprise:G0082 → uses → ATTACK:enterprise:T1140

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3f2be4a4-b7fb-4845-af50-34ca28f03ab3

MIcrosoft Mastra npm Compromise JUN 2026 · 1 - appv

ATTACK:enterprise:G0082 → uses → ATTACK:enterprise:T1059.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--40a8e5c8-9aaa-448e-83f3-853ca0f543e8

Microsoft CYBERWARCON NOV 2024 · Microsoft Axios Compromise APR 2026 · Microsoft Sapphire Sleet APR 2026

ATTACK:enterprise:G0082 → uses → ATTACK:enterprise:T1685.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--41b83cc1-2c0b-461f-b9ec-3e7f51420780

Microsoft Sapphire Sleet APR 2026

ATTACK:enterprise:G0082 → uses → ATTACK:enterprise:S0376

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--41bdaca0-cda7-49ee-a879-bb0dfb0ba6d4

CISA AA20-239A BeagleBoyz August 2020

ATTACK:enterprise:G0082 → uses → ATTACK:enterprise:T1585.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--42d82e3f-b6cf-4624-a2bc-22e32c665f2e

MIcrosoft Mastra npm Compromise JUN 2026

ATTACK:enterprise:G0082 → uses → ATTACK:enterprise:T1059.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--457cc54b-4fd9-490f-bb2f-d7d559624388

CISA AA20-239A BeagleBoyz August 2020 · Microsoft CYBERWARCON NOV 2024 · Microsoft Axios Compromise APR 2026 · 1 - appv

ATTACK:enterprise:G0082 → uses → ATTACK:enterprise:T1074.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4618019f-219d-4a50-be6b-434568bd97d0

Microsoft Sapphire Sleet APR 2026 · MIcrosoft Mastra npm Compromise JUN 2026

ATTACK:enterprise:G0082 → uses → ATTACK:enterprise:T1585.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4778438c-744e-4bc8-9a6f-6532125073ae

Microsoft CYBERWARCON NOV 2024 · Microsoft Axios Compromise APR 2026 · Microsoft Sapphire Sleet APR 2026 · MIcrosoft Mastra npm Compromise JUN 2026

ATTACK:enterprise:G0082 → uses → ATTACK:enterprise:T1027.015

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--534ab21f-c155-46fd-85d0-19eb6b39aa2c

Microsoft Sapphire Sleet APR 2026

ATTACK:enterprise:G0082 → uses → ATTACK:enterprise:T1529

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--53c8e757-8043-4d08-8bd6-8d02d2b973cb

FireEye APT38 Oct 2018

ATTACK:enterprise:G0082 → uses → ATTACK:enterprise:T1204.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5458626f-976e-4007-bb93-43a8a69b0ec1

Microsoft CYBERWARCON NOV 2024 · Microsoft Axios Compromise APR 2026 · MIcrosoft Mastra npm Compromise JUN 2026 · 1 - appv

ATTACK:enterprise:G0082 → uses → ATTACK:enterprise:T1071.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5577d7ff-58ee-4513-bf01-3be1a60ac2c9

FireEye APT38 Oct 2018 · Microsoft Axios Compromise APR 2026 · Microsoft Sapphire Sleet APR 2026

ATTACK:enterprise:G0082 → uses → ATTACK:enterprise:T1105

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--559dfd54-de33-4cfc-aeec-617cd545e870

FireEye APT38 Oct 2018 · Microsoft Axios Compromise APR 2026 · MIcrosoft Mastra npm Compromise JUN 2026 · 1 - appv

ATTACK:enterprise:G0082 → uses → ATTACK:enterprise:T1685

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--57e05fbc-ffbc-4110-a58f-02c5e8813b14

1 - appv

ATTACK:enterprise:G0082 → uses → ATTACK:enterprise:T1583.006

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5d2b6dc4-4c57-41ef-bcf3-8cae67590e50

Microsoft Axios Compromise APR 2026 · MIcrosoft Mastra npm Compromise JUN 2026

ATTACK:enterprise:G0082 → uses → ATTACK:enterprise:T1012

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5dc5e7d5-8d4d-450c-826d-7719de39ab28

MIcrosoft Mastra npm Compromise JUN 2026

ATTACK:enterprise:G0082 → uses → ATTACK:enterprise:T1027.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--61986499-5358-4edc-aab1-6a13ae0f7c06

FireEye APT38 Oct 2018

ATTACK:enterprise:G0082 → uses → ATTACK:enterprise:T1217

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--658f822e-f11c-4c36-8097-8dd21f45b42e

CISA AA20-239A BeagleBoyz August 2020 · MIcrosoft Mastra npm Compromise JUN 2026

ATTACK:enterprise:G0082 → uses → ATTACK:enterprise:T1685.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--65e74662-fe4a-4eaa-a603-cc3fceafb811

FireEye APT38 Oct 2018

ATTACK:enterprise:G0082 → uses → ATTACK:enterprise:T1684.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6cc7ee03-da28-4445-acd3-ce787b0ae61e

Microsoft CYBERWARCON NOV 2024

ATTACK:enterprise:G0082 → uses → ATTACK:enterprise:T1566.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6d2db35f-33b3-4659-b707-770fc1630dd6

Microsoft Axios Compromise APR 2026 · MIcrosoft Mastra npm Compromise JUN 2026

ATTACK:enterprise:G0082 → uses → ATTACK:enterprise:T1059.006

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6dfa7917-c916-43e7-b5a9-1e602e997393

Microsoft Axios Compromise APR 2026

ATTACK:enterprise:G0082 → uses → ATTACK:enterprise:T1543.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6e8b0f50-9923-4bd5-98e0-9e6f2148c256

MIcrosoft Mastra npm Compromise JUN 2026

ATTACK:enterprise:G0082 → uses → ATTACK:enterprise:T1218.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6f6b7e76-fed9-4827-a038-52948105db3d

1 - appv

ATTACK:enterprise:G0082 → uses → ATTACK:enterprise:T1070.006

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6fa3a8bd-3a66-4f48-9439-97e5ae3dcac9

CISA AA20-239A BeagleBoyz August 2020

ATTACK:enterprise:G0082 → uses → ATTACK:enterprise:T1686

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--715428e2-873b-4345-b61d-8d72390cab01

CISA AA20-239A BeagleBoyz August 2020

ATTACK:enterprise:G0082 → uses → ATTACK:enterprise:T1480

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--72654ee9-cf29-49a0-b53c-87de0d9e868d

Microsoft Sapphire Sleet APR 2026

ATTACK:enterprise:G0082 → uses → ATTACK:enterprise:T1583.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--73c1d325-116d-4a33-9b57-912ad12decd5

MIcrosoft Mastra npm Compromise JUN 2026

ATTACK:enterprise:G0082 → uses → ATTACK:enterprise:T1485

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--77cd972c-459f-4cac-ae21-3cc1a96df09e

FireEye APT38 Oct 2018

ATTACK:enterprise:G0082 → uses → ATTACK:enterprise:T1110

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7efb7077-5119-4508-b467-f7da76cc6df6

CISA AA20-239A BeagleBoyz August 2020

ATTACK:enterprise:G0082 → uses → ATTACK:enterprise:T1124

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7f6423c1-9b45-4265-a121-aae7a22b37d9

Microsoft Sapphire Sleet APR 2026

ATTACK:enterprise:G0082 → uses → ATTACK:enterprise:T1059.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--81f6621f-37c2-49ef-81d5-80a9b6a6ae44

Microsoft Axios Compromise APR 2026 · Microsoft Sapphire Sleet APR 2026

ATTACK:enterprise:G0082 → uses → ATTACK:enterprise:T1135

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--82660969-2c24-46a6-a451-1b41240b9ed7

CISA AA20-239A BeagleBoyz August 2020 · Microsoft Sapphire Sleet APR 2026

ATTACK:enterprise:G0082 → uses → ATTACK:enterprise:T1553.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--83757953-5960-42ae-a723-4b4adbe20cd3

1 - appv

ATTACK:enterprise:G0082 → uses → ATTACK:enterprise:T1567

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--83dc348c-50bd-44c2-a368-cf60c6149b5e

MIcrosoft Mastra npm Compromise JUN 2026

ATTACK:enterprise:G0082 → uses → ATTACK:enterprise:T1082

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--870cebf9-bf09-451c-a894-cad79936bb67

CISA AA20-239A BeagleBoyz August 2020 · Microsoft Axios Compromise APR 2026 · Microsoft Sapphire Sleet APR 2026 · MIcrosoft Mastra npm Compromise JUN 2026

ATTACK:enterprise:G0082 → uses → ATTACK:enterprise:T1195.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8a3395f4-737e-4b83-b3e6-8bd824306b7e

Microsoft Axios Compromise APR 2026 · MIcrosoft Mastra npm Compromise JUN 2026

ATTACK:enterprise:G0082 → uses → ATTACK:enterprise:T1132.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8bbb3c5d-da3b-4f55-871d-2fd210dfddea

MIcrosoft Mastra npm Compromise JUN 2026

ATTACK:enterprise:G0082 → uses → ATTACK:enterprise:T1565.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8d94276b-c902-4d7c-ae10-d13e127e5149

FireEye APT38 Oct 2018

ATTACK:enterprise:G0082 → uses → ATTACK:enterprise:T1041

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9124da6c-faad-43e1-a0b9-7a8374ab8c7e

Microsoft Sapphire Sleet APR 2026 · MIcrosoft Mastra npm Compromise JUN 2026

ATTACK:enterprise:G0082 → uses → ATTACK:enterprise:T1686.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9420db13-b21f-4a52-b650-fe9b6b790c4a

CISA AA20-239A BeagleBoyz August 2020

ATTACK:enterprise:G0082 → uses → ATTACK:enterprise:T1561.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--95f54d2e-cfa0-4afc-a5f4-9da7da55242a

FireEye APT38 Oct 2018

ATTACK:enterprise:G0082 → uses → ATTACK:enterprise:T1036.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9baf7b65-eec4-46a6-8e4a-1b8a665a288d

1 - appv

ATTACK:enterprise:G0082 → uses → ATTACK:enterprise:T1690

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9ea5c70d-6f04-4530-925a-5fa0c3521b79

CISA AA20-239A BeagleBoyz August 2020 · Microsoft Axios Compromise APR 2026 · Microsoft Sapphire Sleet APR 2026 · MIcrosoft Mastra npm Compromise JUN 2026

ATTACK:enterprise:G0082 → uses → ATTACK:enterprise:T1036.008

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a1bed260-50a5-4a38-920a-3afa3a68b1a9

Microsoft Axios Compromise APR 2026

ATTACK:enterprise:G0082 → uses → ATTACK:enterprise:T1053.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a3157c50-410e-4218-8707-326ab0146c94

CISA AA20-239A BeagleBoyz August 2020 · 1 - appv

ATTACK:enterprise:G0082 → uses → ATTACK:enterprise:T1552.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a5bea568-25fa-40b7-8ad0-1e30ebec57fc

Microsoft Sapphire Sleet APR 2026

ATTACK:enterprise:G0082 → uses → ATTACK:enterprise:T1588.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a7213656-7166-4b88-8d32-f388a2ef1671

ESET Lazarus KillDisk April 2018

ATTACK:enterprise:G0082 → uses → ATTACK:enterprise:T1505.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ae7727c7-6b4a-48fb-8ecb-b07cbe819cad

CISA AA20-239A BeagleBoyz August 2020

ATTACK:enterprise:G0082 → uses → ATTACK:enterprise:T1552.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b127de87-5a4a-4af9-8743-cc4765e20fab

MIcrosoft Mastra npm Compromise JUN 2026

ATTACK:enterprise:G0082 → uses → ATTACK:enterprise:T1115

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b2a83e1d-f6e8-4cdc-a96e-7bca9a48dfb2

FireEye APT38 Oct 2018

ATTACK:enterprise:G0082 → uses → ATTACK:enterprise:T1555.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b2ab1f44-2c92-4c1e-ba9e-c61737a59323

Microsoft Sapphire Sleet APR 2026 · MIcrosoft Mastra npm Compromise JUN 2026

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.