Andariel

Reported Context (3)

DPRK cluster with espionage and revenue-generation mandates; reportedly used Maui and H0lyGh0st and collaborated with Play in 2024. Sekoia and Kudelski Map North Korea’s Cyber Operations and Supporting Networks
The article cites Andariel attacks on domestic ERP solutions as a similarity to the ERP-modification method; it does not identify Andariel as Larva-26005. ASEC Links Xctdoor Campaigns to Earlier CRAT Attacks in Korea
Reemerged in South Korea, deployed TigerRAT, and attempted to spread Rook ransomware within an engineering company. ESET Report Details APT Campaigns and Threat Trends From October 2025 to March 2026

CVE (1)

Malware (17)

People (6)

Threat Actors (32)

MITRE ATT&CK (24)

Vendors (2)

Products (9)

Tools (1)

Industries (15)

Countries (23)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.