Threat actor · G0094

Kimsuky

Black BansheeVelvet ChollimaEmerald SleetTHALLIUMAPT43TA427SpringtailEarth KumihoPatheticSlug

UnattributedNo public state or group attribution on record

Kimsuky is a Democratic People's Republic of Korea (DPRK)-based cyber espionage group that has been active since at least 2012. The group initially targeted South Korean government agencies, think tanks, and subject-matter experts in various fields. Its operations expanded to include the United Nations and organizations in the government, education, business services, and manufacturing sectors across the United States, Japan, Russia, and Europe.

MITRE ATT&CK Techniques

T1003.001 T1005 T1007 T1012 T1016 T1020 T1021.001 T1027 T1027.001 T1027.002 T1027.007 T1027.010 T1027.012 T1027.013 T1027.015 T1027.016 T1033 T1036.004 T1036.005 T1036.007 T1040 T1041 T1053.005 T1055 T1055.001 T1055.012 T1056.001 T1056.003 T1057 T1059.001 T1059.003 T1059.005 T1059.006 T1059.007 T1070.004 T1070.006 T1071.001 T1071.002 T1071.003 T1074.001 T1078.003 T1082 T1083 T1098.007 T1102.001 T1102.002 T1105 T1106 T1111 T1112 T1113 T1114.002 T1114.003 T1115 T1124 T1132.002 T1133 T1136.001 T1140 T1176.001 T1185 T1190 T1204.001 T1204.002 T1204.004 T1205 T1217 T1218.005 T1218.010 T1218.011 T1219.002 T1480.002 T1489 T1497.001 T1505.003 T1518.001 T1534 T1539 T1543.003 T1546.001 T1547.001 T1550.002 T1552.001 T1552.004 T1553.002 T1555.003 T1557 T1559.001 T1560.001 T1560.003 T1564.002 T1564.003 T1564.011 T1566 T1566.001 T1566.002 T1567.002 T1568 T1583 T1583.001 T1583.004 T1583.006 T1584.001 T1585 T1585.001 T1585.002 T1586.002 T1587 T1587.001 T1588.002 T1588.003 T1588.005 T1589.002 T1589.003 T1591 T1593.001 T1593.002 T1594 T1596 T1598 T1598.003 T1608.001 T1620 T1657 T1678 T1680 T1682 T1684.001 T1685 T1686

Associated Malware

AmadeyAppleSeedBabySharkBrave PrinceCSPY DownloaderGoBearGold DragonGomirHTTPTroyKGH_SPYMimikatzNOKKIPsExecQuasarRATTRANSLATEXTTroll Stealercertutilgh0st RATschtasks

Full MITRE ATT&CK profile

0 recent articles mention this actor

No recent coverage in the current feed. This actor may be quiet, or reporting hasn't used a matched alias.