Threat Intelligence Tarot
Major Arcana · 9
North Korea (Reconnaissance General Bureau, financial unit)
G0082★★★★★
risk 4/5
✦ The Alchemist ✦
APT38
Bluenoroff · TEMP.Hermit
BanksSWIFT network participantsFinancial services globally
Active since ~2014 · Currency generation, Sanctions evasion, Financial system manipulation
It turns network packets into gold. APT38 is the finance department of a rogue state - patient, methodical, willing to spend months inside a bank network learning its SWIFT workflows before issuing fraudulent transfers and then burning the evidence on the way out.
Tactics & Techniques
RCN
RDV
INI
EXC
PRS
PRV
EVA
CRD
DSC
LAT
COL
C2
EXF
IMP
Notable Operations
- ◆Bangladesh Bank $81M SWIFT heist (2016)
- ◆Banco de Chile $10M theft (2018)
- ◆Taiwan Far Eastern Bank targeting
- ◆Multiple African and Asian bank intrusions
Defenses
- ▸SWIFT Customer Security Programme mandatory controlsSWIFT CSP
- ▸Dual-control authorization for large wire transfersFFIEC guidance
- ▸Anomaly detection on SWIFT message patternsNIST CSF: DE.AE ↗
- ▸Out-of-band verification for large or unusual transactionsFFIEC guidance
Reversed: Their Weakness
The Bangladesh Bank heist almost succeeded perfectly - but the fraudulent transfers were partially flagged by the Federal Reserve Bank of New York, and a typo in one transfer instruction ('fandation' vs 'foundation') triggered a review.
Share this adversary profile
swipe to browse
Related Adversaries
Data sourced from MITRE ATT&CK. For educational purposes.