Center for Threat-Informed Defense

Version 18.0 19.0

Groups : ICS ATT&CK Changelog

Modified Groups

Description

APT38 is a North Korean state-sponsored threat group that specializes in financial cyber operations; it has been attributed to the Reconnaissance General Bureau.[1] Active since at least 2014, APT38 has targeted banks, financial institutions, casinos, cryptocurrency exchanges, SWIFT system endpoints, and ATMs in at least 38 countries worldwide. Significant operations include the 2016 Bank of Bangladesh heist, during which APT38 stole $81 million, as well as attacks against Bancomext [2] and Banco de Chile [2]; some of their attacks have been destructive.[1][2][3][4]

North Korean group definitions are known to have significant overlap, and some security researchers report all North Korean state-sponsored cyber activity under the name Lazarus Group instead of tracking clusters or subgroups.

References:

  1. DHS/CISA. (2020, August 26). FASTCash 2.0: North Korea's BeagleBoyz Robbing Banks. Retrieved September 29, 2021.
  2. FireEye. (2018, October 03). APT38: Un-usual Suspects. Retrieved November 17, 2024.
  3. Department of Justice. (2021, February 17). Three North Korean Military Hackers Indicted in Wide-Ranging Scheme to Commit Cyberattacks and Financial Crimes Across the Globe. Retrieved June 9, 2021.
  4. GReAT. (2017, April 3). Lazarus Under the Hood. Retrieved April 17, 2019.
Details
Dictionary Item Added
FIELD OLD VALUE NEW VALUE
spec_version 2.1
Values Changed
FIELD OLD VALUE NEW VALUE
modified 2025-01-22 21:54:11.727000+00:00 2025-11-13 19:21:05.133000+00:00
external_references[11]['url'] https://www.mandiant.com/sites/default/files/2021-09/rpt-apt38-2018-web_v5-1.pdf https://services.google.com/fh/files/misc/apt38-un-usual-suspects.pdf
x_mitre_attack_spec_version 3.2.0 3.3.0

Description

Wizard Spider is a Russia-based financially motivated threat group originally known for the creation and deployment of TrickBot since at least 2016. Wizard Spider possesses a diverse arsenal of tools and has conducted ransomware campaigns against a variety of organizations, ranging from major corporations to hospitals.[1][2][3]

References:

  1. Hanel, A. (2019, January 10). Big Game Hunting with Ryuk: Another Lucrative Targeted Ransomware. Retrieved May 12, 2020.
  2. DHS/CISA. (2020, October 28). Ransomware Activity Targeting the Healthcare and Public Health Sector. Retrieved October 28, 2020.
  3. Podlosky, A., Hanel, A. et al. (2020, October 16). WIZARD SPIDER Update: Resilient, Reactive and Resolute. Retrieved June 15, 2021.
Details
Dictionary Item Added
FIELD OLD VALUE NEW VALUE
spec_version 2.1
Values Changed
FIELD OLD VALUE NEW VALUE
modified 2025-03-12 20:33:21.597000+00:00 2026-01-20 16:26:04.859000+00:00
external_references[17]['url'] https://www.mandiant.com/sites/default/files/2021-10/fin12-group-profile.pdf https://web.archive.org/web/20220313061955/https://www.mandiant.com/sites/default/files/2021-10/fin12-group-profile.pdf
x_mitre_attack_spec_version 3.2.0 3.3.0
x_mitre_version 4.0 4.1
Iterable Item Added
FIELD OLD VALUE NEW VALUE
aliases Pistachio Tempest
aliases DEV-0237
external_references {'source_name': 'Pistachio Tempest', 'description': '(Citation: Microsoft_PistachioTempest_Jan2024)'}
external_references {'source_name': 'DEV-0237', 'description': '(Citation: Microsoft_PistachioTempest_Jan2024)'}
external_references {'source_name': 'Microsoft_PistachioTempest_Jan2024', 'description': 'Microsoft. (2024, January 25). Financially Motivated Threat Actor Pistachio Tempest. Retrieved December 15, 2025.', 'url': 'https://www.microsoft.com/en-us/security/security-insider/threat-landscape/pistachio-tempest'}