APT38
No sourced public emblem in this profile.
research profile · reported nexus: KP (not nationality)
MITRE ATT&CK tracks APT38 as a North Korea-linked activity group associated with financial operations. This profile keeps that label separate from the broader Lazarus umbrella; a source relationship is not proof that all incidents have identical operators.
Source-reported aliases: BlueNoroff (source-dependent association). Associations do not prove equivalence.
Kinwilder analysis
When comparing financial-intrusion reports, preserve the distinction between foothold, authorization abuse and movement of value. Similar objectives do not prove identical teams. Build detections around independently observed behaviors and retain each report's original attribution scope.
Target geography
Catalog-listed countries (associations, not attack counts): No country-level metadata
No bound claim-post feed for this label.
Historical casebook
No dated record curated yet; absence does not establish inactivity.
Planned Kinwilder coverage
Tentative editorial review windows, contingent on evidence and review; not promised publication dates or predictions of attacks.
2026-10-27: One transaction, several meanings. Where can transaction intent change between a signer, a wallet service and the chain?
References
https://attack.mitre.org/groups/G0082/