Threat actors from the North Korean APT43 group have come into light after security researchers unveiled new shifts in targeting and operational changes. Active since 2018, APT43 operates in support of North Korean interests and has recently been targeting government entities, manufacturing, educational institutions, and business services throughout the United States, Japan, and South Korea. Previously motivated by cyberespionage, APT43 has begun shifting to more financially motivated attacks through several cryptocurrency laundering schemes. Additionally, APT43 actors lean on their sophisticated social engineering attacks as a primary point of compromise for their operations, more often utilizing fake online personas to gain trust and persuade users to download custom malicious payloads. Malware utilized by APT43 includes custom built in-house scripts alongside variants of “Pencildown”, “Venombite”, “Pendown”, and the “Hangman” backdoor. During some operations conducted around the COVID-19 pandemic, APT43 actors were rumored to have utilized custom malware from the Lazarus hacking group. APT43 continues to evolve as a threat organization and is becoming more of an asset to the Kimsuky family of actors. CTIX continues to monitor threat actor activity worldwide and will provide additional updates accordingly.