Ruby Sleet is a North Korea-linked threat actor targeting COVID-19 research and vaccine development sectors.
Ruby Sleet, also tracked as CERIUM, is a threat actor linked to North Korea's Ministry of State Security. This group primarily targets companies involved in COVID-19 research and vaccine development. Their key TTPs include conducting spear-phishing campaigns to compromise devices and launching joint cyberattacks with other North Korean threat actors. Defenders should focus on email security, remain vigilant against suspicious attachments, and strengthen monitoring for theft attempts targeting intellectual property.
Ruby Sleet is a threat actor linked to North Korea's Ministry of State Security. Cerium has been involved in spear-phishing campaigns, compromising devices, and conducting cyberattacks alongside other North Korean threat actors. They have also targeted companies involved in COVID-19 research and vaccine development.
Ruby Sleet primarily targets companies involved in COVID-19 research and vaccine development.
One of the group's key TTPs is conducting spear-phishing campaigns to compromise devices.
Every claim on this page is drawn from the cited source (MISP Galaxy, MITRE ATT&CK, ransomware.live) — no attribution is invented.