APT43
- Primary motivation
- espionage
- Sophistication
- intermediate
- Resource level
- government
- Actor type
- nation-state
- Last IoC activity
- 2026-07-21 00:38:42
- Profile updated
- 2026-07-07 11:53:48
Targeted industries: government-and-public-sector education-and-nonprofits defense-and-aerospace
Targeted regions: country_code:kr country_code:us
Context
• APT43 is a prolific cyber operator that supports the interests of the North Korean regime. The group combines moderately-sophisticated technical capabilities with aggressive social engineering tactics, especially against South Korean and U.S.-based government organizations, academics, and think tanks focused on Korean peninsula geopolitical issues. • In addition to its espionage campaigns, we believe APT43 funds itself through cybercrime operations to support its primary mission of collecting strategic intelligence. • The group creates numerous spoofed and fraudulent personas for use in social engineering, as well as cover identities for purchasing operational tooling and infrastructure. • APT43 has collaborated with other North Korean espionage operators on multiple operations, underscoring the major role APT43 plays in the regime’s cyber apparatus.
Reports & references
- mandiant.widen.net — Apt43 Report (report)
- Mandiant — Apt43 North Korea Cybercrime Espionage (report)