North Korea Cyber Group Conducts Global Espionage Campaign to Advance Regime’s Military and Nuclear Programs

This advisory attributes widespread cyber espionage to DPRK RGB 3rd Bureau (Andariel), describing exploitation of many public-facing vulnerabilities (including Log4Shell and numerous CVEs), deployment of web shells and custom RATs, credential theft (Mimikatz, NTDS.dit extraction), lateral movement and data exfiltration to actor-controlled infrastructure and cloud services, and use of ransomware to fund operations; it provides IOCs (MD5/SHA-256/hardcoded user agents), YARA detection rules, MITRE ATT&CK mappings, and prioritized mitigations for critical infrastructure.