Skip to content
skopnix
← Adversaries

File · UNC4736 · Nation-state · assessed origin North Korea · refreshed 2026-10-18

UNC4736

  • Gleaming Pisces
  • Citrine Sleet
  • UNC1720

state sponsor · Korea (Democratic People's Republic of)MITRE G1049 ↗

UNC4736 — ATT&CK roseUN

attack rose · 2 techniques across 2 tactics

Analyst brief

UNC4736 is a North Korean threat actor that has been involved in supply chain attacks targeting software chains of 3CX and X_TRADER. They have used malware strains such as TAXHAUL, Coldcat, and VEILEDSIGNAL to compromise Windows and macOS systems. UNC4736 has been linked to financially motivated cybercrime operations, particularly focused on cryptocurrency and fintech-related services. They have also demonstrated infrastructure overlap with other North Korean and APT43 activity.

Kill chain

MITRE ATT&CK Enterprise · tap a technique

2 techniques · 2 of 15 tactics

  1. Initial access

    1 technique

  2. Impact

    1 technique

select a technique

Take it with you

keyless · no signup

References

7 sources
  1. 1.mandiant.com/resources/blog/3cx-software-supply-chain-compromise
  2. 2.attack.mitre.org/groups/G1049
  3. 3.cloud.google.com/blog/topics/threat-intelligence/3cx-software-supply-ch…
  4. 4.reports.dtexsystems.com/DTEX-Exposing+DPRK+Cyber+Syndicate+and+Hidden+IT+Workf…
  5. 5.cloud.google.com/blog/topics/threat-intelligence/north-korea-cyber-stru…
  6. 6.unit42.paloaltonetworks.com/threat-assessment-north-korean-threat-groups-2024
  7. 7.blogs.jpcert.or.jp/en/2025/03/classifying-lazaruss-subgroup.html

Track UNC4736 on the wire.

This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.

Follow on TelegramKEV RSSAPI

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.