ctrlINT What the industry said about every indicator, with the quote

Opal SleetThreat actor

  • osmium
  • vedalia

Konni is a threat actor associated with APT37, a North Korean cyber crime group. They have been active since 2012 and are known for their cyber-espionage activities. Konni has targeted various sectors, including education, government, business organizations, and the cryptocurrency industry.From MISP Galaxy

Last reported 1 month ago, by SOCRadar1 report

Suspected originNorth KoreaMISP Galaxy

ATT&CK techniques

6 of 24 · each with the sentence it comes from
  1. T1005Data from Local System

    “T1005”

    SOCRadarVendor
  2. T1016System Network Configuration Discovery

    “T1016”

    SOCRadarVendor
  3. T1036Masquerading

    “These archives contained LNK files masquerading as PDFs, using lures focused on global food price growth due to the Strait of Hormuz situation, Russia-Ukraine peace negotiation frameworks, and social researcher resumes to deceive targets.”

    SOCRadarVendor
  4. T1036.005Match Legitimate Resource Name or Location

    “T1036.005”

    SOCRadarVendor
  5. T1036.007Double File Extension

    “T1036.007”

    SOCRadarVendor
  6. T1041Exfiltration Over C2 Channel

    “T1041”

    SOCRadarVendor

Reports per month

last 12 months

October so far (hatched). Counted by report, not by story.

What the reports say

1 report, newest first · the exact sentence from each

  1. “Konni (also tracked as TA406 and Opal Sleet) is a DPRK-nexus threat actor primarily tasked with strategic intelligence collection since at least 2014.”

    SOCRadarVendor
    Operation Conflict Compass: Konni Targets Ukraine via Malicious LNK Lures

Indicators in its reports

named in the reports above
Copy these 20 indicators · defanged

Thanks — we review every report.

Report a wrong match
What is wrong with Opal Sleet here?
No account needed. We do not store your IP address.