Kimsuky

Origin🇰🇵 Coreia do Norte

Techniques (MITRE ATT&CK)130

SourceMITRE ATT&CK

State sponsor: Korea (Democratic People's Republic of)Attribution confidence: 50%Target categories: Government, Private sector

Targeted regions: Ministry of Unification · Sejong Institute · Korea Institute for Defense Analyses · Germany

Also known as:APT43Black BansheeEarth KumihoEmerald SleetG0086Operation Stolen PencilPatheticSlugSparkling PiscesSpringtailTA427THALLIUMThalliumVelvet Chollima

About the group

Kimsuky is a Democratic People's Republic of Korea (DPRK)-based cyber espionage group that has been active since at least 2012. The group initially targeted South Korean government agencies, think tanks, and subject-matter experts in various fields. Its operations expanded to include the United Nations and organizations in the government, education, business services, and manufacturing sectors across the United States, Japan, Russia, and Europe. Kimsuky has focused collection on foreign policy and national security issues tied to the Korean Peninsula, nuclear policy, and sanctions. Kimsuky operations have overlapped with those of other North Korean state-sponsored cyber espionage actors as a result of ad hoc collaborations or other limited resource sharing. Kimsuky was assessed to be responsible for the 2014 Korea Hydro & Nuclear Power Co. compromise; other notable campaigns include Operation STOLEN PENCIL (2018), Operation Kabar Cobra (2019), and Operation Smoke Screen (2019). In 2023, Kimsuky was observed using commercial large language models (LLMs) to assist with vulnerability research, scripting, social engineering and reconnaissance. DPRK threat actor cluster boundaries overl

Attack chain

Plausible scenario built from the group's real techniques, ordered by the phases of an attack. Each step shows how the group typically operates.

Arsenal severity86

Impact: High

Illustrative chain derived from techniques documented in MITRE ATT&CK — it does not represent a specific past attack. Severity summarizes the known arsenal (kill-chain coverage, actively exploited CVEs, techniques).

Techniques (MITRE ATT&CK) 130

How the group operates, mapped to the MITRE ATT&CK matrix and organized by the phases of an attack.

Reconnaissance

Email Addresses Employee Names Gather Victim Org Information Social Media Search Engines Search Victim-Owned Websites Search Open Technical Databases Phishing for Information Spearphishing Link Query Public AI Services

Resource development

Acquire Infrastructure Domains Server Web Services Domains Establish Accounts Social Media Accounts Email Accounts Email Accounts Develop Capabilities Malware Tool Code Signing Certificates Exploits Upload Malware

Initial access

Exploit Public-Facing Application Phishing Spearphishing Attachment Spearphishing Link

Execution

Scheduled Task PowerShell Windows Command Shell Visual Basic Python JavaScript Native API Malicious Link Malicious File Malicious Copy and Paste Component Object Model

Persistence

Additional Local or Domain Groups External Remote Services Local Account Browser Extensions Web Shell Windows Service Registry Run Keys / Startup Folder

Privilege escalation

Change Default File Association

Credential access

LSASS Memory Network Sniffing Multi-Factor Authentication Interception Steal Web Session Cookie Credentials In Files Private Keys Credentials from Web Browsers Adversary-in-the-Middle

Discovery

System Service Discovery Query Registry System Network Configuration Discovery System Owner/User Discovery Process Discovery System Information Discovery File and Directory Discovery System Time Discovery Browser Information Discovery Security Software Discovery Local Storage Discovery

Lateral movement

Remote Desktop Protocol Internal Spearphishing Pass the Hash

Collection

Data from Local System Keylogging Web Portal Capture Local Data Staging Screen Capture Remote Email Collection Email Forwarding Rule Clipboard Data Browser Session Hijacking Archive via Utility Archive via Custom Method

Command and control

Web Protocols File Transfer Protocols Mail Protocols Dead Drop Resolver Bidirectional Communication Ingress Tool Transfer Non-Standard Encoding Remote Desktop Software Dynamic Resolution

Exfiltration

Automated Exfiltration Exfiltration Over C2 Channel Exfiltration to Cloud Storage

Impact

Service Stop Financial Theft

defense-impairment

Modify Registry Code Signing Disable or Modify Tools Disable or Modify System Firewall

Exploited vulnerabilities 3

CVEs this group is known to exploit, per MITRE ATT&CK. Ordered by real-world severity.

CVE-2020-0688HIGHEPSS 100%KEV MITRE ATT&CK

CVE-2014-7169CRITICALEPSS 100%KEV MITRE ATT&CK

CVE-2016-6662EPSS 68% MITRE ATT&CK

Known infrastructure 69

Real indicators (C2, domains, URLs and hashes) associated with the malware this group uses. Source: abuse.ch (ThreatFox, URLhaus, MalwareBazaar).

sha256_hashdce69e096e6b7a54db14431f5208870070503e1961e3f9912c6bbc42fd43ac55Amadeythreatfox

sha256_hash427beb78a7bf619fe38d09ef036c4d0c12eb92cf5765db8d216242ddc3df6538Amadeythreatfox

sha256_hash6E7BC331F4783AD99D83D127FBD2B9540AB34A51242FDC7305343F086BE65746Amadeythreatfox

sha256_hashF8770351861C949E2D528B2DB8FFB0331B0F54F82CC321DBF3EA6C59A6D6BA31Amadeythreatfox

ip:port193.178.158.107:80Amadeythreatfox

urlhttp://193.178.158.107/Bjsw3DlG1/index.phpAmadeythreatfox

urlhttp://194.102.105.70/8jdjZhdf7/Login.phpAmadeythreatfox

md5_hash5a52ab26c92887b367383c8c47d1f825Amadeythreatfox

sha1_hash6ac13b1d254972f48fab7a854cec277261c3538eAmadeythreatfox

sha256_hash52ebd649910eac2754dd5631d388dfdcf25e200be19918d1c94999225729a73cAmadeythreatfox

md5_hash6f2da55a79f65a87ad3d36492e7fb9f0Amadeythreatfox

sha256_hashbb04d6d6fccd0c5eaaeb02bc0c904c0122e9a61d0756b579c2d0da760190b576Amadeythreatfox

sha1_hashf425d0cdc51db0f3e0bcb70ea600767655c67fb2Amadeythreatfox

urlhttp://194.102.105.70/8jdjZhdf7/index.phpAmadeythreatfox

urlhttp://194.102.105.70/8jdjZhdf7/Plugins/cred.dllAmadeyurlhaus

urlhttp://194.102.105.70/8jdjZhdf7/Plugins/cred64.dllAmadeyurlhaus

sha256_hash3f050137b9f180dc883989c7717227cedfeb4c72ebfeca415578b8c5a875fa6aAmadeythreatfox

sha256_hasha0aba2cd26e36e75b4a1c49aa63438b5cc442ee164e0edb94cd35444ee999b2dAmadeythreatfox

md5_hashd022bb6de095252f2b2051fe822c3fbeAmadeythreatfox

sha1_hash447ca548a1d7d6cbb50eafe0d0edc1580cf55c41Amadeythreatfox

sha256_hash2b20eb4237ad2eab05c4a2ad261bcfd436663cf32e2a45526e17dfd3a51a095dAmadeythreatfox

md5_hashc5616af2cef3dcdb095d8cc55db75c96Amadeythreatfox

sha1_hash3c584320e4f7523645ed71d09321d2f5a476f103Amadeythreatfox

sha256_hash76e6367d8123171afa540fe92a3758424ec7d1e029c4e5a3b9771e24fe0085c1Amadeythreatfox

md5_hash9b93fde0cd1f8252a2abf2239ae56f9dAmadeythreatfox

sha1_hashc5f12a9d191c2baf64d66eb1f2edd6754333260dAmadeythreatfox

sha256_hash0ebd28830251fc40845f4201396c683b0026828f3dc25873abdb6feac66820adAmadeythreatfox

urlhttp://cloudscrsolutions.com/v8sjh3hs8/index.phpAmadeythreatfox

urlhttp://atraflaxtt.com/g9sjh3djv/index.phpAmadeythreatfox

urlhttp://jazoopsloo.info/k92lsA3dpb/index.phpAmadeythreatfox

+69 indicators in total. See them all on the IOCs page.

References

Kimsuky uses real techniques and exploits real flaws. TrueHacking's AI Autonomous Pentest simulates these attacks against your infrastructure and brings more security to your application.

Explore the AI Autonomous Pentest →