APT43 is a North Korea-aligned cyber espionage group known for social engineering with spoofed personas and cybercrime to fund operations.
Analyst brief
APT43 is a cyber espionage group that supports the interests of the North Korean regime. The group primarily targets government organizations, academics, and think tanks focused on Korean peninsula geopolitical issues, particularly in South Korea and the United States. Their key TTPs include aggressive social engineering using spoofed personas, moderately sophisticated technical capabilities for intelligence collection, and funding operations through cybercrime. Defenders should heighten awareness around social engineering attacks, especially those involving fraudulent online profiles, and focus on personnel who work on geopolitical topics.
APT43
unknown
• APT43 is a prolific cyber operator that supports the interests of the North Korean regime. The group combines moderately-sophisticated technical capabilities with aggressive social engineering tactics, especially against South Korean and U.S.-based government organizations, academics, and think tanks focused on Korean peninsula geopolitical issues.
• In addition to its espionage campaigns, we believe APT43 funds itself through cybercrime operations to support its primary mission of collecting strategic intelligence.
• The group creates numerous spoofed and fraudulent personas for use in social engineering, as well as cover identities for purchasing operational tooling and infrastructure.
• APT43 has collaborated with other North Korean espionage operators on multiple operations, underscoring the major role APT43 plays in the regime’s cyber apparatus.
APT43 primarily targets government organizations, academics, and think tanks focused on Korean peninsula geopolitical issues, particularly in South Korea and the United States.
How does APT43 fund its operations?+
APT43 funds itself through cybercrime operations to support its primary mission of collecting strategic intelligence.