APT43 Report.pdf

Executive summary: This Mandiant report profiles APT43, a North Korean state-aligned cyber operator that conducts strategic espionage (targeting governments, academia, think tanks, and industry across South Korea, the U.S., Japan, and Europe) and supplements operations through financially-motivated cybercrime including cryptocurrency laundering; the report documents TTPs (spear-phishing, credential harvesting, spoofed domains), extensive malware tooling (LATEOP, LOGCABIN, PENCILDOWN, VENOMBITE, etc.), MITRE ATT&CK mappings, overlaps with other DPRK clusters, and sample IOCs to support detection and response.