# North Korea Andariel targets defense and aerospace via web shell exploits

Published: 2025-07-17 · Severity: high · Sectors: defense, government-national, energy, healthcare, manufacturing, technology, transportation, education, infrastructure
Canonical: https://vorant.io/reports/e6903029-db15-5ee2-9d88-b5cf59d15ef2/north-korea-andariel-targets-defense-and-aerospace-via-web-shell-exploits

> North Korean state cyber group Andariel conducts global espionage against defense, aerospace, and nuclear sectors; exploits public-facing web servers to deploy shells and RATs.

The FBI, CISA, NSA, and allied intelligence agencies have released a joint advisory documenting persistent cyber espionage operations by North Korea's RGB 3rd Bureau, operating under multiple aliases including Andariel, Onyx Sleet, and Silent Chollima. The group targets defense contractors, aerospace firms, nuclear research organizations, and engineering companies worldwide to steal technical specifications, design documents, and intellectual property supporting North Korea's military and nuclear programs.

The group gains initial access by exploiting known vulnerabilities in public-facing web servers—most prominently CVE-2021-44228 (Log4Shell) in Apache Log4j, but also TeamCity, Citrix NetScaler, MOVEIt, FortiGate, and over 30 other CVEs listed since 2017. Once inside, operators deploy web shells, establish persistence via scheduled tasks, enumerate systems using native tools and custom discovery utilities, steal credentials with Mimikatz and similar utilities, and exfiltrate files to attacker-controlled cloud storage or FTP servers. The group operates a suite of custom RATs (Jupiter, MagicRAT, TigerRAT, ValidAlpha, others) developed over 15 years, along with commodity tools and open-source proxies to tunnel traffic despite network protections. Andariel also funds operations through ransomware against U.S. healthcare entities, sometimes conducting espionage and ransomware attacks against the same target on the same day.

## Mentioned in this report

- Vulnerabilities: CVE-2021-20038 (KEV), CVE-2021-3018 (templated), CVE-2021-36955 (KEV), CVE-2021-40684, CVE-2021-41773 (KEV), CVE-2021-43207, CVE-2021-43226 (KEV), CVE-2021-44142, CVE-2021-44228 (KEV), CVE-2021-45837 (weaponized), CVE-2022-21882 (KEV), CVE-2022-22005, CVE-2022-22947 (KEV), CVE-2022-22965 (KEV), CVE-2022-24663, CVE-2022-24664, CVE-2022-24665, CVE-2022-24785, CVE-2022-24990 (KEV), CVE-2022-25064, CVE-2022-27925 (KEV), CVE-2022-30190 (KEV), CVE-2022-41352 (KEV), CVE-2022-47966 (KEV), CVE-2023-0669 (KEV), CVE-2023-21932, CVE-2023-25690, CVE-2023-27997 (KEV), CVE-2023-2868 (KEV), CVE-2023-28771 (KEV), CVE-2023-3079 (KEV), CVE-2023-32315 (KEV), CVE-2023-32784, CVE-2023-33010 (KEV), CVE-2023-33246 (KEV), CVE-2023-34362 (KEV), CVE-2023-35078 (KEV), CVE-2023-3519 (KEV), CVE-2023-42793 (KEV), CVE-2023-46604 (KEV)

## Detection guidance (public sample)

### Web Server Process Spawning Shell or Discovery Utility (Web Shell Activity)

ATT&CK: T1190

Web server worker processes (IIS, Apache, nginx, PHP-CGI) spawning cmd/PowerShell or native discovery tools, consistent with web shell use after exploitation of a public-facing application. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Web Server Process Spawning Shell or Discovery Utility (Web Shell Activity)
description: Detects web server worker processes spawning command interpreters or
  native discovery utilities. Matches post-exploitation web shell behaviour (shell
  execution followed by whoami/net/systeminfo style enumeration) rather than any specific
  shell file name.
tags:
- attack.initial-access
- attack.t1190
- attack.persistence
- attack.t1505.003
- attack.discovery
- attack.t1087
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
    - \w3wp.exe
    - \httpd.exe
    - \nginx.exe
    - \php-cgi.exe
  selection_child:
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \whoami.exe
    - \net.exe
    - \net1.exe
    - \systeminfo.exe
    - \ipconfig.exe
    - \nltest.exe
    - \quser.exe
    - \tasklist.exe
    - \certutil.exe
    - \bitsadmin.exe
  condition: selection_parent and selection_child
falsepositives:
- Web applications that legitimately shell out to cmd.exe for admin or deployment
  functions
- Monitoring or health-check scripts launched by IIS application pools
level: high
id: 13f49996-6579-53e3-936e-35e86cb06b4a
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-207a
```

### Java Process Spawning Shell with Download or Encoded Command (Log4Shell-style Exploitation)

ATT&CK: T1190

Java application servers spawning cmd/PowerShell with download-cradle or encoded-command arguments, typical of Log4Shell and similar RCE exploitation of public-facing apps. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Java Process Spawning Shell with Download or Encoded Command (Log4Shell-style
  Exploitation)
description: Detects java.exe spawning cmd or PowerShell with download cradle, encoded
  command, or LOLBin download arguments. Generalises on the exploitation of Java-based
  public-facing apps (Log4Shell, TeamCity) leading to payload staging.
tags:
- attack.initial-access
- attack.t1190
- attack.execution
- attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
    - \java.exe
    - \javaw.exe
  selection_child:
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
  selection_args:
    CommandLine|contains:
    - -enc
    - downloadstring
    - downloadfile
    - invoke-webrequest
    - iwr
    - certutil
    - bitsadmin
    - curl
    - http://
    - https://
  condition: selection_parent and selection_child and selection_args
falsepositives:
- Java-based build or CI servers (e.g. TeamCity, Jenkins) running scripts that download
  dependencies
- Java application installers invoking PowerShell to fetch components
level: medium
id: 2f1925d4-2466-59e8-969d-58de81cd5afb
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-207a
```

### Mimikatz Named Pipe Created

ATT&CK: T1003

Named pipe whose name contains mimikatz, indicating credential dumping tooling such as that used by Andariel. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Mimikatz Named Pipe Created
description: Detects creation of a named pipe containing the string mimikatz, associated
  with Mimikatz credential theft modules (e.g. remote or service-based execution).
tags:
- attack.credential-access
- attack.t1003
logsource:
  category: pipe_created
  product: windows
detection:
  selection:
    PipeName|contains: mimikatz
  condition: selection
falsepositives:
- Red team or penetration test exercises using unmodified Mimikatz
- Security tooling test suites that emulate Mimikatz
level: high
id: 68219fc9-1c72-503b-a875-fafb9d616cc6
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-207a
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

1 more detection for this report is in the app: the rules that match its indicators, the Sigma rules already converted to Splunk SPL, to Elastic where their fields map onto Elastic's integrations and to Microsoft Defender XDR KQL wherever Defender records the activity, and the YARA and Suricata. A new account gets three days of them free.

Source reporting: https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-207a

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/e6903029-db15-5ee2-9d88-b5cf59d15ef2/north-korea-andariel-targets-defense-and-aerospace-via-web-shell-exploits.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup