Cyber threats

ATT&CK Techniques against North Korea

Techniques used by the threat actors that target North Korea, by tactic · MITRE ATT&CK profiles · darker = more actors
1
Actors with a profile
24
Techniques
T1001
Most used · 1 actors
Reset
Reconnaissance0
—
Resource Development0
—
Initial Access1
T1566 Phishing1
Execution6
T1053 Scheduled Task/Job1 T1059 Command and Scripting Interpreter1 T1106 Native API1 T1203 Exploitation for Client Execution1 T1204 User Execution1 T1574 Hijack Execution Flow1
Persistence2
T1053 Scheduled Task/Job1 T1547 Boot or Logon Autostart Execution1
Privilege Escalation2
T1053 Scheduled Task/Job1 T1547 Boot or Logon Autostart Execution1
Stealth6
T1027 Obfuscated Files or Information1 T1036 Masquerading1 T1140 Deobfuscate/Decode Files or Information1 T1220 XSL Script Processing1 T1564 Hide Artifacts1 T1574 Hijack Execution Flow1
Defense Impairment0
—
Credential Access0
—
Discovery5
T1016 System Network Configuration Discovery1 T1057 Process Discovery1 T1082 System Information Discovery1 T1124 System Time Discovery1 T1680 Local Storage Discovery1
Lateral Movement0
—
Collection0
—
Command and Control4
T1001 Data Obfuscation1 T1071 Application Layer Protocol1 T1090 Proxy1 T1573 Encrypted Channel1
Exfiltration2
T1029 Scheduled Transfer1 T1041 Exfiltration Over C2 Channel1
Impact0
—
Techniques to detect first
TechniqueTacticsActorsUsed by, for example
T1001 Data Obfuscation command-and-control 1 Higaisa
T1016 System Network Configuration Discovery discovery 1 Higaisa
T1027 Obfuscated Files or Information stealth 1 Higaisa
T1029 Scheduled Transfer exfiltration 1 Higaisa
T1036 Masquerading stealth 1 Higaisa
T1041 Exfiltration Over C2 Channel exfiltration 1 Higaisa
T1053 Scheduled Task/Job execution, persistence, privilege-escalation 1 Higaisa
T1057 Process Discovery discovery 1 Higaisa
T1059 Command and Scripting Interpreter execution 1 Higaisa
T1071 Application Layer Protocol command-and-control 1 Higaisa
T1082 System Information Discovery discovery 1 Higaisa
T1090 Proxy command-and-control 1 Higaisa

Each actor counts once per technique; sub-techniques are counted under their parent. Only actors with a MITRE ATT&CK profile are included (1), so the map shows documented tradecraft, not everything that happens.