Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Jumpy Pisces Engages in Play Ransomware

Summary: Unit 42 identified Jumpy Pisces, a North Korean state-sponsored group tied to the Reconnaissance General Bureau of the Korean People's Army, as gaining initial access through a compromised user account in May 2024 and maintaining persistence with the open-source tool Sliver and its custom malware DTrack until early September, when Play ransomware was deployed. Unit 42 assesses with moderate confidence that Jumpy Pisces, also known as Andariel and Onyx Sleet, collaborated with the Play ransomware group, marking the first observed instance of the group using existing ransomware infrastructure, possibly as an initial access broker or affiliate.

Bottom line: Attackers held access to the network from May to September 2024, and the DTrack execution was blocked by EDR while Sliver beaconing continued for months - a state-sponsored group that historically ran espionage and its own Maui ransomware is now tied to an underground ransomware operation, which Unit 42 expects to spread to a wider range of victims globally.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Detection & Response
Related
YARA-X 1.23.0 Release, (Sun, Nov 15th) Cyber Risks · Nov 15, 2026