Palo Alto Networks Unit 42 disclosed evidence linking North Korean state-sponsored threat group Jumpy Pisces (also tracked as Andariel, Onyx Sleet, and APT45) to the deployment of Play ransomware (Fiddling Scorpius). Incident responders observed an intrusion originating in May 2024 via compromised user credentials, where actors established persistent command-and-control using the open-source Sliver C2 framework. During a four-month dwell period, the threat actor conducted internal reconnaissance, dumped LSASS memory using Mimikatz, and distributed the proprietary DTrack backdoor across internal workstations via SMB to harvest browser vaults and system telemetry.

In September 2024, Sliver C2 beaconing ceased immediately before the same compromised account executed pre-ransomware staging routines, including privilege escalation and the suppression of endpoint detection and response (EDR) agents. Adversaries then deployed the Play ransomware binary network-wide. The findings represent the first recorded operational nexus between North Korean Reconnaissance General Bureau (RGB) cyber units and an underground Ransomware-as-a-Service (RaaS) syndicate. Security researchers assess Jumpy Pisces operated either as a direct RaaS affiliate or as an initial access broker monetizing enterprise footholds to generate illicit state revenue.

Why it matters:

• Bullet 1 — Technical & Architecture Risk: State-sponsored actors leveraging off-the-shelf C2 tooling alongside custom loaders defeat behavioral heuristics, while unmonitored credential re-use enables quiet lateral migration and defense evasion before triggering rapid, high-impact ransomware encryptors.
• Bullet 2 — Strategic & Defender Imperative: Security teams must isolate identity providers with phishing-resistant MFA, continuously audit Active Directory replication and credential-dumping anomalies, and monitor for dual-use command-and-control frameworks like Sliver to sever initial broker footholds before extortion deployment.