Threat intelligence

Suspected origin

North Korea

TLP

WHITE

A subgroup of Lazarus Group, Hidden Cobra, Labyrinth Chollima.

Also known as

AndarielAPT 45G0138Jumpy PiscesOnyx SleetPlutoniumSilent ChollimaStonefly

Tooling and malware

gh0st RATRifdoor

MITRE ATT&CK techniques

T1005 Data from Local SystemT1105 Ingress Tool TransferT1049 System Network Connections DiscoveryT1057 Process DiscoveryT1203 Exploitation for Client ExecutionT1189 Drive-by Compromise

Coverage 3

ransomware

Gunra Ransomware Exploits Fortinet and Schneider Electric Flaws to Breach Networks

The Gunra ransomware group, linked to state-sponsored actors, is aggressively targeting critical infrastructure and organizations globally, leveraging vulnerabilities in Fortinet and Schneider Electric appliances to gain…

The Hacker News · Aug 11, 2026 High

CVE-2024-5559CVE-2025-24472SOBRSPransomwarevulnerabilitysupply-chain

threat-intel

North Korea’s Lazarus Group sharing tools with ransomware hackers, South Korean agencies warn

North Korea's Lazarus Group is sharing its cyber tools and infrastructure with ransomware hackers, specifically the Gunra group, targeting South Korean organizations. The agencies warn that even visiting compromised legi…

The Record · Jul 30, 2026 High

SONOnorth korearansomwarelazarus group

threat-intel

ESET APT Activity Report Q4 2025–Q1 2026

ESET’s Q4 2025 – Q1 2026 APT Activity Report highlights a period of intense geopolitical activity driving advanced cyber espionage. China-aligned actors were mobilized to monitor maritime and energy developments, while I…

WeLiveSecurity · May 28, 2026 High

CHIRPOaptcyber espionagegeopolitics

All articles