Edit: Andariel — CryptoScamsWiki

Title / name *

Summary *

Category *

Scam type *

Severity *

Chain

Token

Amount lost (USD)

Image

Upload

Paste a link or upload a file (max 5 MB).

Details (Markdown supported)

> **On attribution:** Andariel is a North Korea-linked cluster within the Lazarus/RGB umbrella; attributions are those of the cited authorities (U.S. DOJ, CISA, Treasury).

## Overview

Andariel — also tracked as Onyx Sleet, APT45, Silent Chollima, DarkSeoul, and Stonefly/Clasiopa — is a unit of North Korea's Reconnaissance General Bureau (3rd Bureau). It was sanctioned by the U.S. Treasury in September 2019. CISA and partners describe it as having evolved from destructive attacks into cyber-espionage (targeting defense, aerospace, nuclear, and engineering sectors) plus financially motivated ransomware. [1][2]

## Maui ransomware and indictment

In July 2024 the U.S. DOJ unsealed an indictment charging Andariel member Rim Jong Hyok with conspiring to deploy "Maui" ransomware against U.S. hospitals and healthcare companies, extorting ransoms and laundering the proceeds — which were then used to fund further espionage intrusions against government, defense, and technology targets. The State Department offered up to $10 million for information; Rim remains at large. [1][2]

_Bracketed numbers refer to the numbered sources listed below._

Aliases (one per line)

Wallets (chain:address per line)

Propose an edit