Ruby SleetThreat actor
- cerium
Ruby Sleet is a threat actor linked to North Korea's Ministry of State Security. Cerium has been involved in spear-phishing campaigns, compromising devices, and conducting cyberattacks alongside other North Korean threat actors. They have also targeted companies involved in COVID-19 research and vaccine development.From MISP Galaxy
Last reported 7 months ago, by Zscaler ThreatLabz1 report
ATT&CK techniques
6 of 30 · each with the sentence it comes from- T1027Obfuscated Files or Information
“T1027”
- T1027.009Embedded Payloads
“Then, the PowerShell script launched by the LNK file carves multiple embedded payloads from fixed offsets within that LNK, including a decoy document, an executable payload, an additional PowerShell script, and a batch file, as listed in the table below.”
- T1036Masquerading
“Masquerading: Match Legitimate Name or Location”
- T1036.005Match Legitimate Resource Name or Location
“T1036.005”
- T1052Exfiltration Over Physical Medium
“Exfiltration Over Physical Medium: Exfiltration over USB”
- T1052.001Exfiltration over USB
“T1052.001”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
1 report, newest first · the exact sentence from each-
APT37 Adds New Capabilities for Air-Gapped Networks“In December 2025, Zscaler ThreatLabz discovered a campaign linked to APT37 (also known as ScarCruft, Ruby Sleet, and Velvet Chollima), which is a DPRK-backed threat group.”
Indicators in its reports
named in the reports above- 57dac5f7d21da2454d0fbefdced80bf3in 1 report
- ed54cf1ebffbfc1c8ae1ccdd2c681012in 1 report
- scfile[.]readin 1 report
- hxxps://www.philion[.]store/star/main.phpin 1 report
- www.philion[.]storein 1 report
- hxxps://www.homeatedke[.]store/star/main.phpin 1 report
- www.homeatedke[.]storein 1 report
- hxxps://www.hightkdhe[.]store/star/main.phpin 1 report
- www.hightkdhe[.]storein 1 report
- hightkdhe[.]storein 1 report
- 709d70239f1e9441e8e21fcacfdc5d08in 1 report
- ad556f4eb48e7dba6da14444dcce3170in 1 report
- 098d697f29b94c11b52c51bfe8f9c47din 1 report
- 4214818d7cde26ebeb4f35bc2fc29adain 1 report
- 5c6ff601ccc75e76c2fc99808d8cc9a9in 1 report
- 476bce9b9a387c5f39461d781e7e22b9in 1 report
- 585322a931a49f4e1d78fb0b3f3c6212in 1 report
- philion[.]storein 1 report
- homeatedke[.]storein 1 report
- 144.172.106[.]66in 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.