After over a decade tracking the group under names including Andariel, Silent Chollima, and Onyx Sleet, Mandiant formally elevated the North Korean threat actor to full advanced persistent threat status on July 25, 2024, designating it APT45. The designation was coordinated with a joint CISA/FBI/NSA/NCSC advisory and a US Department of Justice indictment against operative Rim Jong Hyok.
Stealing Blueprints on Demand
Mandiant principal analyst Michael Barnhart put APT45's core mission plainly:
"When Kim Jong Un demands better missiles, these are the guys who steal the blueprints for him. APT45 isn't bound by ethical considerations and have demonstrated they're willing and agile enough to target any entity to achieve their objectives, including hospitals."
Since at least 2009, APT45 has systematically targeted government agencies, defence contractors, nuclear facilities, and financial institutions across South Korea, the United States, India, and beyond. The 2019 compromise of India's Kudankulam Nuclear Power Plant — one of the few confirmed cases of North Korean actors hitting civilian nuclear infrastructure — is attributed directly to the group.
Espionage Funded by Healthcare Ransomware
APT45 is unique among North Korean operators in having developed and deployed ransomware — specifically Maui and SHATTEREDGLASS — against US healthcare organisations to fund continued espionage activity. Mandiant assesses with moderate confidence that ransom proceeds are laundered and used to procure further intrusion infrastructure and support broader North Korean state priorities.
Evolving Targeting Over 15 Years
- 2009–2016: South Korean government and financial targets
- 2019: Nuclear facilities including Kudankulam NPP; energy sector expansion
- 2020: Crop science multinational amid North Korean domestic agricultural crisis
- 2021–2024: US and allied healthcare, defence industrial base, aerospace
Mandiant published a VirusTotal Collection of APT45-related indicators alongside the report to support global defender hunting efforts.