ASEC reports on activity by North Korean state-sponsored APT Andariel Group (publicly attributed to the DPRK Reconnaissance General Bureau by the US Treasury) against South Korean companies. AndarLoader and Modeloader (described as JavaScript malware) are downloaders used to take control and install Mimikatz for credential stealing. MeshAgent is (potentially unwanted application) abused as remote monitoring and management (RMM). ASEC describes a lot of TTPs that could be mapped to MITRE ATT&CK. IOC provided. 🔗 https://asec.ahnlab.com/en/63192/

#NorthKorea #cyberespionage #APT #Andariel #RGB #Modeloader #AndarLoader #MeshAgent #threatintel #IOC