Wednesday, May 14, 2025
HomeCVE/vulnerabilityNorth Korean Onyx Sleet Using Group Of Malware And Exploits to Gain...

North Korean Onyx Sleet Using Group Of Malware And Exploits to Gain Intelligence

Published on

SIEM as a Service

Follow Us on Google News

Onyx Sleet, a cyber espionage group also known as SILENT CHOLLIMA, Andariel, DarkSeoul, Stonefly, and TDrop2, mainly targets the military, defense sector, and technology in the United States, South Korea, and India.

The group historically used spear-phishing, but they have now started using N-day vulnerabilities, such as in their October 2023 attack on TeamCity.

To improve functionality and evade detection, Onyx Sleet mixes open-source tools with customized ones and continually develops new RATs.

- Advertisement - Google News

The team uses leased virtual private servers or compromised cloud infrastructure for its command-and-control operations.

Cybersecurity researchers at Microsoft recently discovered that the operators behind Onyx Sleet have been actively using an array of malware to gather intelligence for North Korea.

Join our free webinar to learn about combating slow DDoS attacks, a major threat today.

North Korean Onyx Sleet

On July 25, 2024, the U.S. Department of Justice indicted an individual linked to Onyx Sleet, a North Korean cyber threat actor tracked by Microsoft since 2014. 

This group, known for cyber espionage and, more recently, financial gain, employs custom tools and evolving malware to target global organizations, particularly in the defense, engineering, and energy sectors. 

Onyx Sleet shows affiliations with other North Korean actors, notably Storm-0530, sharing infrastructure and ransomware development. 

Microsoft collaborates with the FBI to monitor Onyx Sleet’s activities, directly notifying affected customers and providing security guidance to combat these persistent threats.

Onyx Sleet targeted a South Korean educational institution, a construction company, and a manufacturing organization in May 2024.

Here, the financial gain may be why they are interested in online gambling websites.

Onyx Sleet has changed its methods by creating custom ransomware and using Dtrack RAT into their campaigns without leaving persistent TTPs.

Security analysts observed the Dtrack RAT globally from September 2019 to January 2024. It exploited flaws such as Log4j (CVE-2021-44228) and employed signed payloads for evasion purposes.

Onyx Sleet attack chain (Source – Microsoft)

In May 2024, AhnLab Security Intelligence Center uncovered a campaign that illustrated how the group’s attack chain had evolved while remaining similar in terms of structure.

Here below we have mentioned all the vulnerabilities that Onyx Sleet recently exploited:-

Onyx Sleet introduced the Go-based Dora RAT in a campaign targeting South Korean organizations. To evade detection, the group employs custom encryption, obfuscation, and in-memory execution. 

Their toolkit includes custom malware like TDrop2, off-the-shelf tools like Sliver, and commercial packers like Themida. 

In January 2024, Onyx Sleet deployed a Sliver implant signed with an invalid Tableau certificate, compromising aerospace and defense organizations from October 2023 to June 2024. 

The group exploits well-known and custom vulnerabilities, targeting various applications, including remote desktops, data loss prevention, network access control, and EDR products, primarily affecting South Korean users.

The custom malware families used in Onyx Sleet’s attacks are TigerRAT, SmallTiger, LightHand, and ValidAlpha.

Recommendations

Here below we have mentioned the recommendations provided:-

  • Make sure to update software promptly.
  • Apply security patches immediately.
  • Enable cloud-delivered protection in your AV tool.
  • Activate network protection.
  • Use EDR in block mode to intercept threats missed by other AV solutions.
  • Set investigation and remediation to fully automated mode.

Protect Your Business Emails From Spoofing, Phishing & BEC with AI-Powered Security | Free Demo

Tushar Subhra
Tushar Subhra
Tushar is a Cyber security content editor with a passion for creating captivating and informative content. With years of experience under his belt in Cyber Security, he is covering Cyber Security News, technology and other news.

Latest articles

Threat Actors Leverage Weaponized HTML Files to Deliver Horabot Malware

A recent discovery by FortiGuard Labs has unveiled a cunning phishing campaign orchestrated by...

TA406 Hackers Target Government Entities to Steal Login Credentials

The North Korean state-sponsored threat actor TA406, also tracked as Opal Sleet and Konni,...

Google Threat Intelligence Releases Actionable Threat Hunting Technique for Malicious .desktop Files

Google Threat Intelligence has unveiled a series of sophisticated threat hunting techniques to detect...

New Adobe Photoshop Vulnerability Enables Arbitrary Code Execution

Adobe has released critical security updates addressing three high-severity vulnerabilities (CVE-2025-30324, CVE-2025-30325, CVE-2025-30326) in...

Resilience at Scale

Why Application Security is Non-Negotiable

The resilience of your digital infrastructure directly impacts your ability to scale. And yet, application security remains a critical weak link for most organizations.

Application Security is no longer just a defensive play—it’s the cornerstone of cyber resilience and sustainable growth. In this webinar, Karthik Krishnamoorthy (CTO of Indusface) and Phani Deepak Akella (VP of Marketing – Indusface), will share how AI-powered application security can help organizations build resilience by

Discussion points


Protecting at internet scale using AI and behavioral-based DDoS & bot mitigation.
Autonomously discovering external assets and remediating vulnerabilities within 72 hours, enabling secure, confident scaling.
Ensuring 100% application availability through platforms architected for failure resilience.
Eliminating silos with real-time correlation between attack surface and active threats for rapid, accurate mitigation

More like this

Threat Actors Leverage Weaponized HTML Files to Deliver Horabot Malware

A recent discovery by FortiGuard Labs has unveiled a cunning phishing campaign orchestrated by...

TA406 Hackers Target Government Entities to Steal Login Credentials

The North Korean state-sponsored threat actor TA406, also tracked as Opal Sleet and Konni,...

Researchers Unveil New Mechanism to Track Compartmentalized Cyber Threats

Cisco Talos, in collaboration with The Vertex Project, has introduced an innovative approach to...