216.73.217.22

DPRK

· Published 20/12/2025 23:19 · Modified 20/12/2025 23:19 · Source: AlienVault

Essential information

Confidence
100/100
Published
20/12/2025 23:19
Modified
20/12/2025 23:19
Updated at
20/12/2025 23:19
Revoked
No
Author / Source
AlienVault
Resource level
—
Primary motivation
—
Related entities
6 reports, 68 attack patterns (mitre), 16 malware, 6 sectors, 4 countries, 102 indicators, 4 vulnerabilities (cve)

Description

No description.

Marking (TLP)

TLP:CLEAR

Related entities

Attack patterns, malware, vulnerabilities, indicators and other entities linked to this intrusion set.

Reports (6)

Attack patterns (MITRE) (68)

Malware (16)

  • BeaverTail uses
    Family
    Published 21/04/2026 12:09 · Modified 21/04/2026 12:09
  • ChromeUpdate uses
    AlienVault Confidence 100
    First seen 01/01/1970 · Last seen 16/11/5138 Published 21/12/2025 09:42 · Modified 21/12/2025 09:42
  • DPRK
  • SparkRAT uses
    Family
    Published 20/02/2026 00:28 · Modified 20/02/2026 00:28
  • FROSTYFERRET_UI uses
    Family
    Published 04/02/2025 08:35 · Modified 04/02/2025 08:35
  • Maui
  • Ryuk
  • FRIENDLYFERRET_SECD uses
    AlienVault Confidence 100
    First seen 01/01/1970 · Last seen 16/11/5138 Published 20/12/2025 19:50 · Modified 21/12/2025 09:42
  • MULTI_FROSTYFERRET_CMDCODES uses
    Family
    Published 04/02/2025 08:35 · Modified 04/02/2025 08:35
  • NimDoor uses
    Family
    Published 04/07/2025 09:39 · Modified 04/07/2025 09:39
  • H0lyGh0st
  • InvisibleFerret uses
    Family
    Published 21/04/2026 12:09 · Modified 21/04/2026 12:09
  • WarmCookie uses
    Family
    Published 28/01/2026 18:26 · Modified 28/01/2026 18:26
  • ClickFix uses
    Family
    Published 14/05/2026 11:16 · Modified 14/05/2026 11:16
  • FlexibleFerret uses
    Family
    Published 08/06/2026 10:05 · Modified 08/06/2026 10:05
  • XWorm uses
    Family
    Published 27/03/2026 08:45 · Modified 27/03/2026 08:45

Sectors (6)

  • Healthcare targets
  • Government targets
  • Public Health targets
  • Technology targets
  • Chemical targets
  • Finance targets

Countries (4)

  • Latvia targets
  • Korea, Republic of targets
  • Singapore targets
  • United States of America targets

Indicators (102)

Vulnerabilities (CVE) (4)

CVE-2021-20038 KEV

SonicWall SMA 100 devies are vulnerable to an unauthenticated stack-based buffer overflow vulnerability where exploitation can result in code execution.

Published
28/01/2022
Modified
20/12/2025
CVE-2022-24990 KEV
7.5 High

TerraMaster OS contains a remote command execution vulnerability that allows an unauthenticated user to execute commands on the target endpoint.

Attack vector
Network
Published
10/02/2023
Modified
20/12/2025
CVE-2024-27198 KEV
9.8 Critical

JetBrains TeamCity contains an authentication bypass vulnerability that allows an attacker to perform admin actions.

Attack vector
Network
Published
07/03/2024
Modified
21/12/2025
CVE-2021-44228 KEV
10.0 Critical

Apache Log4j2 contains a vulnerability where JNDI features do not protect against attacker-controlled JNDI-related endpoints, allowing for remote code execution.

Attack vector
Network
Published
10/12/2021
Modified
27/05/2026