Sanctioned North Korean unit tried to hack at least 3 US organizations this summer

Symantec reports that North Korean APT45 (Andariel/Stonefly) carried out intrusions against at least three U.S. private organizations in August, employing custom malware and forged certificates (including a fake Tableau certificate) with indicators matching Microsoft’s recent findings; the activity appears financially motivated (extortion) but ransomware was not successfully deployed, and operations have continued despite sanctions and an indictment of an alleged member.