BlueNoroff
Named by 3 kept items in this workspace.
2 items name it under threat actors and 1 under classification.key entities.
Search every workspace for BlueNoroff. It matches the name as written, so it can find other things that share it.
The items that name it 3
DPRK-linked threat cluster; internal project name 'macWebT' in the malware links directly to BlueNoroff's documented webT module from RustBucket malware campaigns
All threat actors in this workspace.