North Korea's 'Stonefly' APT Swarms US Private Co's. for Profit

Stonefly, a North Korean APT linked to the Reconnaissance General Bureau, has pivoted toward financially motivated intrusions against U.S. private companies; Symantec observed August compromises that deployed custom backdoors (Backdoor.Preft/Dtrack/Valefor), Nukebot, credential theft tools (Mimikatz, keyloggers), and offensive frameworks (Sliver), and used unique certificates and other IoCs—ransomware was likely the intended endgame but was not executed in the observed cases.