Threat feed IOCs (48)

Indicators from free threat feeds (abuse.ch ThreatFox, AlienVault OTX) attributed to Silent Chollima. Each row shows why it was linked and where it came from.

Public research & publications (10)

Open-source reports about this actor collected from MISP Galaxy and MITRE ATT&CK.

• issuemakerslab.comhttp://www.issuemakerslab.com/research3/
• adversary.crowdstrike.comhttps://adversary.crowdstrike.com/en-US/adversary/silent-chollima/
• attack.mitre.orghttps://attack.mitre.org/groups/G0138
• fsiceat.tistory.comhttps://fsiceat.tistory.com/2
• home.treasury.govhttps://home.treasury.gov/news/press-releases/sm774
• learn.microsoft.comhttps://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide
• web.archive.orghttps://web.archive.org/web/20230213154832/http://download.ahnlab.com/global/brochure/%5BAnalysis%5DAndariel_Group.pdf
• trendmicro.comhttps://www.trendmicro.com/en_us/research/18/g/new-andariel-reconnaissance-tactics-hint-at-next-targets.html
• docs.huihoo.comhttps://docs.huihoo.com/rsaconference/usa-2014/anf-t07b-the-art-of-attribution-identifying-and-pursuing-your-cyber-adversaries-final.pdf
• microsoft.comhttps://www.microsoft.com/en-us/security/blog/2023/10/18/multiple-north-korean-threat-actors-exploiting-the-teamcity-cve-2023-42793-vulnerability/