From stealing confidential data to revenue-generating attacks

The Andariel Group has been active in South Korea since 2014, targeting the defense industry, cybersecurity companies, political institutions, and the financial sector. They primarily use spear phishing emails and exploiting vulnerabilities in ActiveX and IT management systems to infect victims. Their malware and tools have evolved over time from 2014 to 2018 to include malware like Bmdoor, Rifdoor, Phandoor, Andarat, and GhostRat. They have conducted operations like Operation Black Mine and hacked into major companies, the Seoul ADEX in 2015, ATMs, and a large travel agency.