APT38

APT38 is Mandiant's name for the part of DPRK financial operations that robs institutions. Against banks in Bangladesh, Vietnam, Poland, Mexico, Chile and elsewhere, operators spend months learning one bank's payment workflow, issue fraudulent transfers inside it, then destroy the systems that would reveal it.

A second line, FASTCash, compromises the card payment switch so intruders approve withdrawals and empty ATMs across many countries within hours. Whether APT38 is a subset of Lazarus or a peer cluster is disputed; Mandiant also hedges that UNC4899 (TraderTraitor) may be former APT38 operators.

Named individuals

None profiled on this site yet

Fabricated personas

None reconstructed under this tag

Indicators

810 in the searchable index

Hunts

1 in the hunt library

How it differs from the other clusters here

Dwell time is the distinguishing feature: months of reconnaissance precede any theft, which must be executed as a valid transaction.

Understanding the target's business process is the operation; the intrusion is preparation.

It ends loudly, with wiper malware or log destruction against systems that would evidence the transfer, unlike the IT-worker cluster approach of staying unremarkable.

Compare Lazarus GroupKimsukyRGB (Reconnaissance General Bureau)Remote Worker Fraud / Contagious InterviewAndarielAPT37KonniMoonstone SleetPolinRider

What a defender would see

Relevant only to a narrow set of organisations, whose key telemetry is the interbank messaging environment rather than the endpoint estate.

Watch SWIFT-originating workstations, the local Alliance software and database, reconciliation reports and the card payment switch.

The practical signal is a mismatch between systems that should agree, such as a transfer in the network's records but not the bank's own.

Likewise a switch approving withdrawals the core system has no record of, or a reconciliation report that stopped covering an account.

• IOC Hunt high Compromised Legitimate npm Release: axios 1.14.1 and 0.30.4 A routine dependency bump that resolved to axios 1.14.1 or 0.30.4, whose added dependency plain-crypto-js dropped a cross-platform remote-access tool from sfrclak.com:8000, as OpenSourceMalware documents and reports Google and Microsoft attributing to a North Korea-nexus actor. WindowsmacOSLinux Cortex XQL · CrowdStrike LogScale · Defender / Sentinel KQL · Elastic · Sigma · Splunk SPL · YARA · osquery

Indicators

The 810 indicators the index holds under this cluster. The complete index is on Remote Workers.

Show more results

Where the evidence comes from

Show 50 more

Further reading

Published research on this cluster. None of it is this site’s work.

• APT38: Un-usual Suspects FireEye, now Mandiant at Google Cloud · 2018-10-01

  The report that separated this cluster from Lazarus in the first place, and still the best account of the operational sequence: reconnaissance, months inside the payment workflow, fraudulent transfer, destruction. A PDF.

• FASTCash 2.0: North Korea's BeagleBoyz Robbing Banks (AA20-239A) CISA, U.S. Treasury, FBI and U.S. Cyber Command · 2020-08-26

  The government account of the ATM cash-out scheme, and the place to read about the payment-switch compromise specifically. Marked as archived content, but it remains the reference description of how switch responses are forged.

• TraderTraitor: North Korean State-Sponsored APT Targets Blockchain Companies (AA22-108A) FBI, CISA and U.S. Treasury · 2022-04-18

  Where the same financial mission went once banks hardened: cryptocurrency exchanges and blockchain firms, reached by social-engineering their employees rather than through the interbank network.

• Three North Korean Military Hackers Indicted in Wide-Ranging Scheme to Commit Cyberattacks and Financial Crimes Across the Globe U.S. Department of Justice · 2021-02-17

  The U.S. charging account of the Bangladesh Bank theft and the attempts that followed it, useful as the prosecution's version of the story the vendor reporting tells.

• TA444: APT Startup Aimed at Acquisition (of Your Funds) Proofpoint · 2023-01-25

  Proofpoint's own designation for this cluster, stated to overlap with APT38, BlueNoroff, Stardust Chollima and COPERNICIUM. Good on the phishing and credential-theft side of the operation rather than the SWIFT-fraud side.

• Dissecting Sapphire Sleet's macOS intrusion from lure to compromise Microsoft Threat Intelligence · 2026-04-16

  Microsoft's current reporting on the name it now uses for this cluster, including the fake-recruiter and fake-investor lures aimed at individual cryptocurrency holders rather than institutions.

• How Microsoft names threat actors Microsoft Learn · 2026-08-18

  The source for the Sapphire Sleet alias table used above: COPERNICIUM, UNC1069, Stardust Chollima, Alluring Pisces, BlueNoroff, CageyChameleon and CryptoCore, listed together as one name's other names.

• Assessed Cyber Structure and Alignments of North Korea in 2023 Mandiant (Google Cloud) · 2023-10-10

  The source for Mandiant's hedged UNC1069/UNC4899 language quoted above, and the clearest published account of how these financially-motivated clusters relate to APT38 without being asserted as identical to it.