Response to CISA Advisory (AA24-207A): North Korea Cyber Group Conducts Global Espionage Campaign to Advance Regime’s Military and Nuclear Programs

This report summarizes a multi-agency Cybersecurity Advisory on Andariel (Onyx Sleet), a DPRK RGB-associated APT subgroup conducting global espionage against defense, aerospace, nuclear and engineering sectors, detailing their tactics (web server exploitation including Log4j, web shells, phishing with LNK/HTA, scheduled tasks, credential dumping with Mimikatz, RDP lateral movement, C2, and exfiltration) and noting use of Maui ransomware to fund operations; AttackIQ provides an assessment template to emulate these post-compromise TTPs for testing detection and mitigation controls.