APT38, also tracked as BlueNoroff and Sapphire Sleet, is the North Korean state group that turns intrusions into money, and its targets have moved from bank SWIFT terminals to cryptocurrency firms, developer laptops and npm packages. This profile covers who the group is, how vendor names map to it, what it targets, the ATT&CK techniques it uses, how it abuses credentials, signing keys and publishing tokens, and how to detect and defend against it. It is written for security teams in banks, payment processors, cryptocurrency and fintech firms, venture capital and software companies whose packages are widely used. It goes deeper on the financial subgroup than the Lazarus Group Threat Actor Profile, which covers the wider umbrella.
Key takeaways
- A financial unit of the Reconnaissance General Bureau: CISA, the FBI, Treasury and US Cyber Command attribute the BeagleBoyz (APT38) to North Korea's RGB, and the US Department of Justice charged RGB officers with schemes to steal and extort more than USD 1.3 billion.
- Targets follow the money: banks, SWIFT endpoints, ATM switch servers and casinos from about 2014, then cryptocurrency exchanges, wallets, venture capital and blockchain developers.
- Tradecraft is broad: ATT&CK v20 lists 115 techniques for APT38 (G0082), from spearphishing and watering holes to SWIFT message manipulation, macOS TCC bypass, npm package poisoning and MBR wiping.
- Identity is the route to the money: the group harvests passwords, keychains, browser sessions, private keys and npm maintainer accounts, then uses them as valid accounts.
- Defence is mostly basics applied to payment and developer paths: phishing-resistant MFA, isolated payment infrastructure, transaction anomaly detection, locked-down developer endpoints and short-lived, scoped publishing credentials.
Who they are (names and aliases)
MITRE ATT&CK describes APT38 as a North Korean state-sponsored group that specialises in financial cyber operations, attributed to the Reconnaissance General Bureau and active since at least 2014. Kaspersky's 2017 research described Bluenoroff as a smaller unit within Lazarus focused only on financial attacks, while the larger group concentrated on espionage and disruption. ATT&CK notes that North Korean group definitions overlap heavily and that some researchers report all of this activity as Lazarus Group.
| Name | Used by | Notes |
|---|---|---|
| APT38 | Mandiant (FireEye report, October 2018) | ATT&CK primary name, G0082 |
| BlueNoroff (Bluenoroff) | Kaspersky | Financial subgroup of Lazarus, 2017 |
| BeagleBoyz | CISA, FBI, Treasury, USCYBERCOM | Joint advisory AA20-239A, 2020 |
| Stardust Chollima | CrowdStrike | CHOLLIMA family is North Korea |
| Sapphire Sleet (formerly COPERNICIUM) | Microsoft | Microsoft says other vendors track overlapping activity as UNC1069 and BlueNoroff |
| NICKEL GLADSTONE | Secureworks | As listed in ATT&CK |
Names do not map exactly. Google Threat Intelligence attributed the March 2026 axios npm compromise to UNC1069, while Microsoft attributed it to Sapphire Sleet and ATT&CK records it against APT38. The 2025 Bybit theft was attributed by the FBI to TraderTraitor, which is tracked separately from APT38 on the Lazarus page. See the Threat Actor Naming Conventions Guide for how to keep these straight.
Targeting and motivation
The motive is revenue for a sanctioned state. The joint advisory AA20-239A says public estimates put attempted theft at nearly USD 2 billion since at least 2015, and that financial institutions in about 38 countries were likely targeted between 2015 and 2020.
- Banks and SWIFT: the 2016 Bangladesh Bank heist stole USD 81 million; the Federal Reserve Bank of New York stopped the rest of an attempted USD 1 billion (AA20-239A). The 2021 US indictment lists SWIFT theft attempts of over USD 1.2 billion against banks in Vietnam, Bangladesh, Taiwan, Mexico, Malta and Africa between 2015 and 2019.
- ATM cash-outs: the FASTCash campaign compromised payment switch application servers that process ISO 8583 messages, first on AIX and then on Windows, and approved fraudulent withdrawals. The indictment cites USD 6.1 million taken from BankIslami Pakistan in October 2018.
- Cryptocurrency: exchanges, wallets and trading firms, using trojanised trading apps (the AppleJeus family named by the DOJ), fake recruiters and fake venture capital meetings. Microsoft describes Sapphire Sleet as targeting cryptocurrency, venture capital and blockchain organisations, often in the US, Asia and the Middle East, with a primary motive of stealing wallets.
- Software supply chain: since 2026, poisoning npm packages used by developers and CI runners to reach wallet data and secrets at scale.
Tactics and techniques (MITRE ATT&CK)
The table selects techniques from the ATT&CK v20 APT38 entry that matter most for defenders. Each is recorded against the group with a public source.
| Tactic | Technique | How APT38 uses it |
|---|---|---|
| Resource development | T1585.001 Social Media Accounts; T1583.001 Domains | Fake recruiter and investor profiles on professional networks; domains imitating venture capital firms |
| Initial access | T1566.002 Spearphishing Link; T1566.003 Spearphishing via Service; T1189 Drive-by Compromise | Fake meeting invites, LinkedIn messages, watering holes such as a compromised site visited by Polish banks |
| Initial access | T1195.001 Compromise Software Dependencies and Development Tools | Malicious dependencies injected into npm packages (Mastra, axios) |
| Execution | T1059.002 AppleScript; T1059.001 PowerShell; T1546.016 Installer Packages | Fake "SDK update" .scpt files; Base64 PowerShell; npm postinstall hooks |
| Credential access | T1056.002 GUI Input Capture; T1555.001 Keychain; T1555.003 Credentials from Web Browsers; T1552.004 Private Keys | Fake macOS password dialog, keychain theft, browser credential and cookie theft, wallet key theft |
| Defence impairment | T1548.006 TCC Manipulation; T1564.012 File/Path Exclusions; T1685.005 Clear Windows Event Logs | TCC database grants, Defender exclusions for System32, clearing Windows and Sysmon logs |
| Persistence | T1543.001 Launch Agent; T1547.001 Registry Run Keys; T1505.003 Web Shell | Developer-themed LaunchAgents and Run keys, web shells for redundant access |
| Impact | T1565.002 Transmitted Data Manipulation; T1657 Financial Theft | DYEPACK altering SWIFT messages and records; cryptocurrency theft |
| Impact | T1561.002 Disk Structure Wipe; T1486 Data Encrypted for Impact | BOOTWRECK MBR wiper and Hermes ransomware used to cover tracks |
Software recorded for the group includes HOPLIGHT, ECCENTRICBANDWAGON, DarkComet, KillDisk and the open-source tool Mimikatz. See the MITRE ATT&CK Guide for Defenders for how to turn this list into detection coverage.
How they abuse identities and credentials
Almost every APT38 operation ends with a credential or key being used as if it were legitimate. That makes the identity layer, including non-human credentials, the most productive place to defend.
- Human passwords: in the macOS campaign Microsoft analysed in April 2026, a fake system dialog captured the user's login password, validated it against directory services and sent it out over the Telegram Bot API, together with the login keychain so stored secrets could be decrypted offline (T1056.002, T1555.001).
- Sessions: Telegram Desktop session data and Chromium cookies (Chrome, Brave, Arc) were taken, allowing session hijacking without re-authentication. MFA does not help once a session is stolen.
- Wallet keys: IndexedDB storage for dozens of wallet extensions and desktop wallets such as Ledger Live and Exodus were collected (T1552.004). A wallet key is a non-human credential that moves money directly.
- Developer and publishing credentials: ATT&CK records the group using victim npm maintainer accounts to publish malicious versions (T1078.004). In the Mastra npm supply chain attack, a former contributor's account still held publish rights across the scope, and a token tied to it published more than 140 poisoned packages in about 88 minutes. See the npm Tokens Security Guide.
- Payment system credentials: in bank intrusions, operators used valid credentials and access to SWIFT and switch servers; AA20-239A lists valid accounts, trusted third parties and external remote services among initial access methods.
- SSH keys and shell history: collected from macOS and Linux hosts (T1552.003), which can open servers and repositories.
For exchange and custody environments, see the Crypto Exchange Identity and Key Security Guide.
Notable incidents
| Year | Incident | What happened | Source |
|---|---|---|---|
| 2016 | Bangladesh Bank | Fraudulent SWIFT messages; USD 81 million stolen, rest of an attempted USD 1 billion stopped | CISA AA20-239A; Kaspersky |
| 2016 to 2017 | Polish banks watering hole | A government site frequented by banks was compromised to deliver malware | Kaspersky |
| 2018 | BankIslami Pakistan | ATM cash-out, USD 6.1 million | US DOJ indictment |
| 2018 | Bancomext and Banco de Chile | Operations attributed to APT38 | ATT&CK (Mandiant report) |
| 2016 onwards | FASTCash | Switch server compromise approving fraudulent ATM withdrawals | CISA AA20-239A |
| March 2026 | axios npm compromise | Maintainer lured into a fake Teams call; backdoored releases live for about three hours | ATT&CK (Microsoft); NHIMG breach analysis |
| April 2026 | macOS fake SDK update campaign | Fake recruiter and interview lures leading to credential and wallet theft | Microsoft |
| June 2026 | Mastra npm compromise | Hijacked contributor account poisoned 140+ packages | Microsoft; NHIMG breach analysis |
The axios npm compromise shows the developer lure in practice: a maintainer was invited to a branded Slack workspace and a Teams call, told his system was out of date and ran a remote access trojan, which gave the attacker his npm account despite two-factor authentication being enabled.
Detection and defence
Controls mapped to the group's behaviour
| Behaviour | Control | Framework reference |
|---|---|---|
| Fake recruiter and meeting lures | Train finance, engineering and executive staff; require that meeting software is installed only from managed stores | NIST SP 800-53 AT-2; CSF 2.0 PR.AT-01 |
| Script and unsigned binary execution on macOS | Block .scpt and unsigned Mach-O from the internet; restrict osascript and curl piped to shells | NIST SP 800-53 CM-7; D3FEND Executable Allowlisting (D3-EAL) |
| Credential and session theft | Phishing-resistant MFA, short session lifetimes, token binding where available, rotate secrets after any compromise | NIST SP 800-53 IA-2, IA-5 |
| Payment system access | Isolate SWIFT and switch infrastructure, MFA to switch servers, mutual TLS on payment links, Swift CSCF attestation | NIST SP 800-53 AC-4, SC-7 |
| Fraudulent transactions | Log and baseline switch and SWIFT transactions; alert on anomalies and out-of-hours batches | NIST SP 800-53 AU-6, SI-4; CSF 2.0 DE.CM-01 |
| npm and CI poisoning | Install with scripts disabled in CI, pin versions with a cool-off period, trusted publishing with provenance, remove stale maintainers | NIST SP 800-53 SR-3, SR-11; CSF 2.0 GV.SC-07 |
What to monitor
- macOS endpoints: Script Editor or osascript spawning curl or shells, changes to TCC.db, new LaunchAgents and LaunchDaemons with com.apple or com.google names that are not genuine, dscl -authonly calls and traffic to the Telegram Bot API from non-messaging processes (all named by Microsoft).
- Windows endpoints: new Defender exclusions, Run keys starting hidden PowerShell, new auto-start services loading DLLs from ProgramData, and event log clearing (Security event ID 1102).
- Developer pipelines: postinstall execution in CI, new dependencies appearing in a patch release, publishes without provenance from accounts that normally have it, and maintainer email changes.
- Payment systems: SWIFT message volumes and beneficiaries outside baseline, switch server responses that approve transactions without issuer cryptogram validation.
Metrics
- Percentage of finance, treasury and engineering staff on phishing-resistant MFA.
- Mean time to revoke and rotate credentials and tokens after an endpoint compromise.
- Number of npm or package publishers with publish rights who have not published in 12 months (target zero).
- Percentage of CI builds running with install scripts disabled and pinned lockfiles.
- Percentage of payment transactions covered by anomaly rules, and time from alert to hold.
Rollout order
- Inventory payment, wallet and signing systems and the people and machine identities that can reach them.
- Enforce phishing-resistant MFA for those users and for remote access to payment servers; pilot with treasury and engineering first.
- Harden macOS and Windows developer endpoints: script controls in audit mode for two weeks, then enforce, with a documented exception route.
- Remove stale package maintainers, move to trusted publishing and disable long-lived publish tokens.
- Deploy the monitoring above and test it against the ATT&CK techniques in the table using a purple team exercise.
- Rehearse a theft response: freezing transfers, contacting exchanges and law enforcement, and rotating every credential on the affected hosts. Keep rollback simple by staging policy changes per device group.
Practitioner checklist
- Map vendor names (Sapphire Sleet, BlueNoroff, Stardust Chollima, UNC1069) to one record in your intelligence platform.
- Brief finance, engineering and executives on fake recruiter, investor and "SDK update" lures.
- Require phishing-resistant MFA for payment, wallet, cloud and package registry access.
- Isolate SWIFT and switch infrastructure and complete the Swift CSCF attestation honestly.
- Block internet-sourced AppleScript and unsigned binaries on macOS and monitor TCC changes.
- Remove stale publishers, use trusted publishing and disable install scripts in CI.
- Store wallet and signing keys in hardware or custody services, never in browser extensions on daily-use laptops.
- After any suspected compromise, rotate passwords, sessions, SSH keys, API keys and publish tokens on the affected host.
Standards and references
- MITRE ATT&CK: APT38 (G0082)
- CISA: FASTCash 2.0: North Korea's BeagleBoyz Robbing Banks (AA20-239A)
- US Department of Justice: Three North Korean Military Hackers Indicted
- Microsoft Threat Intelligence: Dissecting Sapphire Sleet's macOS intrusion from lure to compromise
- Microsoft Threat Intelligence: Inside the Mastra npm supply chain compromise by Sapphire Sleet
- Kaspersky: Lazarus Under the Hood
- Swift: Customer Security Programme
Related NHI Mgmt Group resources: Lazarus Group Threat Actor Profile · North Korea Cyber Operations Guide · Crypto Exchange Identity and Key Security Guide · Malicious Package and Dependency Confusion Guide