Andariel

Andariel pays for its own espionage. A 2024 U.S. indictment describes ransomware against American hospitals and healthcare providers, with the proceeds funding intrusions into defence contractors, aerospace firms and energy and nuclear engineering organisations.

The victim list therefore looks unrelated, a hospital system and a nuclear engineering firm, and a sector lens will call the group unfocused. It is not: one set of victims pays for access to the other.

Named individuals

1 profiled from law-enforcement records

Fabricated personas

None reconstructed under this tag

Indicators

183 in the searchable index

Hunts

None in the hunt library

How it differs from the other clusters here

Other clusters keep money and intelligence separate; in Andariel a ransom note and the theft of engineering documentation belong to the same operation.

Initial access differs: the joint U.S. and allied advisory emphasises exploitation of known vulnerabilities in internet-facing systems, not persuading a person.

The exposure is a patch level, which changes who owns the risk and what a defender can do in advance.

Compare Lazarus GroupAPT38KimsukyRGB (Reconnaissance General Bureau)Remote Worker Fraud / Contagious InterviewAPT37KonniMoonstone SleetPolinRider

What a defender would see

For healthcare and critical-infrastructure operators, the sequence is ordinary: an unpatched internet-facing system, a web shell, then lateral movement with harvested credentials.

Nothing in it is DPRK-specific; the hygiene that stops a criminal ransomware affiliate stops this.

Staging of documents and engineering data before encryption is not incidental, since the intrusion is also a collection operation.

If ransomware hits a defence, aerospace, energy or nuclear supply-chain organisation, ask the exfiltration question independently of the ransom question.

Every person below is named in a public charging document, sanctions record or law-enforcement wanted notice that carries this cluster tag. Each profile lists the records it draws on and nothing beyond them.

• Rim Jong Hyok림종혁

Indicators

The 183 indicators the index holds under this cluster. The complete index is on Remote Workers.

Show more results

Where the evidence comes from

Show 50 more

Further reading

Published research on this cluster. None of it is this site’s work.

• North Korea Cyber Group Conducts Global Espionage Campaign to Advance Regime's Military and Nuclear Programs (AA24-207A) CISA, FBI, NSA and partner agencies · 2024-07-25

  The joint advisory on this group, and the item to read first. It sets out the dual mission plainly and lists the initial-access vulnerabilities and post-exploitation behaviour the partner agencies observed.

• North Korean Government Hacker Charged for Involvement in Ransomware Attacks Targeting U.S. Hospitals and Health Care Providers U.S. Department of Justice · 2024-07-25

  The indictment of Rim Jong Hyok, published the same day as the advisory. This is where the funding relationship is stated as a charge: ransom proceeds paying for the infrastructure used against defence and energy targets.

• Jumpy Pisces Engages in Play Ransomware Unit 42 (Palo Alto Networks) · 2024-10-30

  Unit 42's own name for this cluster, and a documented case — assessed with moderate confidence — of it collaborating with or acting as an affiliate of the criminal Play ransomware operation rather than deploying its own encryptor.