Skip to content
skopnix
← Adversaries

File · STARDUST CHOLLIMA · Nation-state · assessed origin Korea (Democratic People's Republic of) · refreshed 2026-10-18

STARDUST CHOLLIMA

  • Sapphire Sleet
  • NICKEL GLADSTONE
  • BeagleBoyz
  • Bluenoroff
  • COPERNICIUM

state sponsor · Korea (Democratic People's Republic of)MITRE G0082 ↗

STARDUST CHOLLIMA — ATT&CK roseSC

attack rose · 115 techniques across 13 tactics

Analyst brief

Open-source reporting has claimed that the Hermes ransomware was developed by the North Korean group STARDUST CHOLLIMA (activities of which have been public reported as part of the “Lazarus Group”), because Hermes was executed on a host during the SWIFT compromise of FEIB in October 2017.

Observed targets (as stated by the sources)

3 countries · 0 sectors
North KoreaBangladeshChile

assessed originnot stated by sourcesobserved targets · 3

countries · 3

  • North Korea
  • Bangladesh
  • Chile

as stated by the cited sources, not inferred

Kill chain

MITRE ATT&CK Enterprise · tap a technique

115 techniques · 13 of 15 tactics

  1. Resource development

    10 techniques

  2. Initial access

    5 techniques

  3. Execution

    15 techniques

  4. Persistence

    5 techniques

  5. Privilege escalation

    4 techniques

  6. Stealth

    27 techniques

  7. Defense impairment

    9 techniques

  8. Credential access

    6 techniques

  9. Discovery

    11 techniques

  10. Collection

    8 techniques

  11. Command and control

    4 techniques

  12. Exfiltration

    3 techniques

  13. Impact

    8 techniques

select a technique

Arsenal

4 malware · 2 tools
Malware
Malware · 4ATT&CK
ECCENTRICBANDWAGONS0593 ↗
HOPLIGHTS0376 ↗
KillDiskS0607 ↗
DarkCometS0334 ↗
Tools
Tools · 2ATT&CK
NetS0039 ↗
MimikatzS0002 ↗

as stated by MITRE ATT&CK · “shared by” counts roster dossiers citing the same S-id

Detections

15 rules · Sigma · QRadar · Cortex

  1. Behaviour (ATT&CK technique)

    certutil used to download a remote file (T1105)

    APT-C-36 · APT10 · APT15 · APT18 · APT23 · APT27 · 85 more

    T1105conf 80SIGAQLXQL

  2. Behaviour (ATT&CK technique)

    mshta executing remote or inline script (T1218.005)

    APT29 · APT32 · Confucius · Earth Lusca · FIN7 · Gamaredon Group · 11 more

    T1218.005conf 80SIGAQLXQL

  3. Behaviour (ATT&CK technique)

    PowerShell download cradle executed from the command line (T1059.001)

    APT-C-36 · APT10 · APT19 · APT27 · APT28 · APT29 · 81 more

    T1059.001conf 80SIGAQLXQL

  4. Behaviour (ATT&CK technique)

    Windows event log cleared with wevtutil (T1685.005)

    APT28 · APT32 · APT41 · Aquatic Panda · Chimera · ENERGETIC BEAR · 8 more

    T1685.005conf 80SIGAQLXQL

  5. Behaviour (ATT&CK technique)

    Microsoft Defender protection disabled via Set-MpPreference (T1685)

    APT2 · APT35 · APT41 · APT5 · Aquatic Panda · blackbyte · 27 more

    T1685conf 75SIGAQLXQL

Generated by skopnix from this finding, each with false-positive notes. Open the list →

Take it with you

keyless · no signup

References

8 sources
  1. 1.crowdstrike.com/blog/big-game-hunting-with-ryuk-another-lucrative-targ…
  2. 2.attack.mitre.org/groups/G0082
  3. 3.go.crowdstrike.com/rs/281-OBQ-266/images/Report2021GTR.pdf
  4. 4.justice.gov/opa/pr/three-north-korean-military-hackers-indicted-wi…
  5. 5.us-cert.cisa.gov/ncas/alerts/aa20-239a
  6. 6.services.google.com/fh/files/misc/apt38-un-usual-suspects.pdf
  7. 7.securelist.com/lazarus-under-the-hood/77908
  8. 8.crowdstrike.com/blog/meet-crowdstrikes-adversary-of-the-month-for-apri…

Track STARDUST CHOLLIMA on the wire.

This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.

Follow on TelegramKEV RSSAPI

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.