North Korea Andariel targets defense and aerospace via web shell exploits
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
North Korean state cyber group Andariel conducts global espionage against defense, aerospace, and nuclear sectors; exploits public-facing web servers to deploy shells and RATs.
The FBI, CISA, NSA, and allied intelligence agencies have released a joint advisory documenting persistent cyber espionage operations by North Korea's RGB 3rd Bureau, operating under multiple aliases including Andariel, Onyx Sleet, and Silent Chollima. The group targets defense contractors, aerospace firms, nuclear research organizations, and engineering companies worldwide to steal technical specifications, design documents, and intellectual property supporting North Korea's military and nuclear programs.
The group gains initial access by exploiting known vulnerabilities in public-facing web servers—most prominently CVE-2021-44228 (Log4Shell) in Apache Log4j, but also TeamCity, Citrix NetScaler, MOVEIt, FortiGate, and over 30 other CVEs listed since 2017. Once inside, operators deploy web shells, establish persistence via scheduled tasks, enumerate systems using native tools and custom discovery utilities, steal credentials with Mimikatz and similar utilities, and exfiltrate files to attacker-controlled cloud storage or FTP servers. The group operates a suite of custom RATs (Jupiter, MagicRAT, TigerRAT, ValidAlpha, others) developed over 15 years, along with commodity tools and open-source proxies to tunnel traffic despite network protections. Andariel also funds operations through ransomware against U.S. healthcare entities, sometimes conducting espionage and ransomware attacks against the same target on the same day.
Mentioned in this report
Detection guidance
Web Server Process Spawning Shell or Discovery Utility (Web Shell Activity)
Web server worker processes (IIS, Apache, nginx, PHP-CGI) spawning cmd/PowerShell or native discovery tools, consistent with web shell use after exploitation of a public-facing application. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Web Server Process Spawning Shell or Discovery Utility (Web Shell Activity)
description: Detects web server worker processes spawning command interpreters or
native discovery utilities. Matches post-exploitation web shell behaviour (shell
execution followed by whoami/net/systeminfo style enumeration) rather than any specific
shell file name.
tags:
- attack.initial-access
- attack.t1190
- attack.persistence
- attack.t1505.003
- attack.discovery
- attack.t1087
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|endswith:
- \w3wp.exe
- \httpd.exe
- \nginx.exe
- \php-cgi.exe
selection_child:
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
- \whoami.exe
- \net.exe
- \net1.exe
- \systeminfo.exe
- \ipconfig.exe
- \nltest.exe
- \quser.exe
- \tasklist.exe
- \certutil.exe
- \bitsadmin.exe
condition: selection_parent and selection_child
falsepositives:
- Web applications that legitimately shell out to cmd.exe for admin or deployment
functions
- Monitoring or health-check scripts launched by IIS application pools
level: high
id: 13f49996-6579-53e3-936e-35e86cb06b4a
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-207a
Java Process Spawning Shell with Download or Encoded Command (Log4Shell-style Exploitation)
Java application servers spawning cmd/PowerShell with download-cradle or encoded-command arguments, typical of Log4Shell and similar RCE exploitation of public-facing apps. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Java Process Spawning Shell with Download or Encoded Command (Log4Shell-style
Exploitation)
description: Detects java.exe spawning cmd or PowerShell with download cradle, encoded
command, or LOLBin download arguments. Generalises on the exploitation of Java-based
public-facing apps (Log4Shell, TeamCity) leading to payload staging.
tags:
- attack.initial-access
- attack.t1190
- attack.execution
- attack.t1059
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|endswith:
- \java.exe
- \javaw.exe
selection_child:
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
selection_args:
CommandLine|contains:
- -enc
- downloadstring
- downloadfile
- invoke-webrequest
- iwr
- certutil
- bitsadmin
- curl
- http://
- https://
condition: selection_parent and selection_child and selection_args
falsepositives:
- Java-based build or CI servers (e.g. TeamCity, Jenkins) running scripts that download
dependencies
- Java application installers invoking PowerShell to fetch components
level: medium
id: 2f1925d4-2466-59e8-969d-58de81cd5afb
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-207a
Mimikatz Named Pipe Created
Named pipe whose name contains mimikatz, indicating credential dumping tooling such as that used by Andariel. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Mimikatz Named Pipe Created
description: Detects creation of a named pipe containing the string mimikatz, associated
with Mimikatz credential theft modules (e.g. remote or service-based execution).
tags:
- attack.credential-access
- attack.t1003
logsource:
category: pipe_created
product: windows
detection:
selection:
PipeName|contains: mimikatz
condition: selection
falsepositives:
- Red team or penetration test exercises using unmodified Mimikatz
- Security tooling test suites that emulate Mimikatz
level: high
id: 68219fc9-1c72-503b-a875-fafb9d616cc6
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-207a
1 more detection for this report is in the app — the rules that match its indicators, plus the Sigma rules already converted to Splunk SPL, to Elastic where their fields map onto Elastic's integrations and to Microsoft Defender XDR KQL wherever Defender records the activity, and the YARA and Suricata. Three days of it free, no card.
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-207a
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 614 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs