UNC5267

A Mandiant cluster representing North Korean fraudulent IT-worker activity. Operatives use fabricated identities to obtain remote employment, generate revenue, gain trusted access, and sometimes steal proprietary data or extort companies; it is a distributed scheme rather than a conventional centralized intrusion group.