Kimsuky

OriginCoreia do Norte

Techniques (MITRE ATT&CK)130

SourceMITRE ATT&CK

Also known as:Black BansheeVelvet ChollimaEmerald SleetTHALLIUMAPT43TA427SpringtailEarth KumihoPatheticSlug

Vexday analysis

Kimsuky é um grupo de espionagem cibernética originário da Coreia do Norte (DPRK), ativo pelo menos desde 2012 e rastreado pelo MITRE ATT&CK sob o identificador G0094 — também referenciado pelos aliases Black Banshee, Velvet Chollima, Emerald Sleet, THALLIUM, APT43 e TA427. O grupo iniciou suas operações visando agências governamentais sul-coreanas, think tanks e especialistas temáticos, expandindo posteriormente seu escopo para abranger a ONU e organizações nos setores governamental, educacional, de serviços empresariais e manufatureiro nos Estados Unidos, Japão, Rússia e Europa. Suas coletas são focadas em questões de política externa e segurança nacional relacionadas à Península Coreana, política nuclear e sanções internacionais. Ao grupo são atribuídas 3 CVEs conhecidas e 130 técnicas documentadas no framework MITRE ATT&CK.

Techniques (MITRE ATT&CK) 130

How the group operates, mapped to the MITRE ATT&CK matrix and organized by the phases of an attack.

Reconnaissance

Email Addresses Employee Names Gather Victim Org Information Social Media Search Engines Search Victim-Owned Websites Search Open Technical Databases Phishing for Information Spearphishing Link Query Public AI Services

Resource development

Acquire Infrastructure Domains Server Web Services Domains Establish Accounts Social Media Accounts Email Accounts Email Accounts Develop Capabilities Malware Tool Code Signing Certificates Exploits Upload Malware

Initial access

Exploit Public-Facing Application Phishing Spearphishing Attachment Spearphishing Link

Execution

Scheduled Task PowerShell Windows Command Shell Visual Basic Python JavaScript Native API Malicious Link Malicious File Malicious Copy and Paste Component Object Model

Persistence

Additional Local or Domain Groups External Remote Services Local Account Browser Extensions Web Shell Windows Service Registry Run Keys / Startup Folder

Privilege escalation

Change Default File Association

Credential access

LSASS Memory Network Sniffing Multi-Factor Authentication Interception Steal Web Session Cookie Credentials In Files Private Keys Credentials from Web Browsers Adversary-in-the-Middle

Discovery

System Service Discovery Query Registry System Network Configuration Discovery System Owner/User Discovery Process Discovery System Information Discovery File and Directory Discovery System Time Discovery Browser Information Discovery Security Software Discovery Local Storage Discovery

Lateral movement

Remote Desktop Protocol Internal Spearphishing Pass the Hash

Collection

Data from Local System Keylogging Web Portal Capture Local Data Staging Screen Capture Remote Email Collection Email Forwarding Rule Clipboard Data Browser Session Hijacking Archive via Utility Archive via Custom Method

Command and control

Web Protocols File Transfer Protocols Mail Protocols Dead Drop Resolver Bidirectional Communication Ingress Tool Transfer Non-Standard Encoding Remote Desktop Software Dynamic Resolution

Exfiltration

Automated Exfiltration Exfiltration Over C2 Channel Exfiltration to Cloud Storage

Impact

Service Stop Financial Theft

defense-impairment

Modify Registry Code Signing Disable or Modify Tools Disable or Modify System Firewall

Exploited vulnerabilities 3

CVEs this group is known to exploit, per MITRE ATT&CK. Ordered by real-world severity.

CVE-2020-0688HIGHEPSS 100%KEV CVE-2014-7169CRITICALEPSS 100%KEV CVE-2016-6662EPSS 68%

Kimsuky uses real techniques and exploits real flaws. TrueHacking's AI Autonomous Pentest simulates these attacks against your infrastructure and brings more security to your application.

Explore the AI Autonomous Pentest →