DPRK / Sapphire Sleet
Named by 2 kept items in this workspace.
Search every workspace for DPRK / Sapphire Sleet. It matches the name as written, so it can find other things that share it.
The items that name it 2
North Korean threat actor attributed by Microsoft to the Mastra campaign; the arrayref crate campaign's C2 infrastructure (endpoint /49890878 and shared SSL issuer) substantially overlaps with operations attributed to this actor.
All threat actors in this workspace.