Skip to content

Kimsuky

Kimsuky is a Democratic People's Republic of Korea (DPRK)-based cyber espionage group that has been active since at least 2012. The group initially targeted South Korean government agencies, think tanks, and subject-matter experts in various fields. Its operations expanded to include the United Nations and organizations in the government, education, business services, and manufacturing sectors across the United States, Japan, Russia, and Europe. Kimsuky has focused collection on foreign policy and national security issues tied to the Korean Peninsula, nuclear policy, and sanctions. Kimsuky operations have…

ATT&CK ID: G0094
Origin: North Korea
Weather family: Sleet
Techniques: 87
Tools: 19

Also tracked as Black Banshee · Velvet Chollima · Emerald Sleet · THALLIUM · APT43 · TA427 · Springtail · Earth Kumiho · PatheticSlug

Vulnerabilities it has exploited

CVE-2020-0688 Microsoft Exchange ServerUnscored · exploited in the wild

Techniques

Reconnaissance

Gather Victim Identity Information Gather Victim Org Information Search Open Websites/Domains Search Victim-Owned Websites Search Open Technical Databases Phishing for Information Query Public AI Services

Resource Development

Acquire Infrastructure Compromise Infrastructure Establish Accounts Compromise Accounts Develop Capabilities Obtain Capabilities Stage Capabilities

Initial Access

Valid Accounts External Remote Services Exploit Public-Facing Application Phishing

Execution

Scheduled Task/Job Command and Scripting Interpreter Native API User Execution Inter-Process Communication

Persistence

Scheduled Task/Job Valid Accounts Account Manipulation Modify Registry External Remote Services Create Account Software Extensions Traffic Signaling Server Software Component Create or Modify System Process Event Triggered Execution Boot or Logon Autostart Execution

Privilege Escalation

Scheduled Task/Job Process Injection Valid Accounts Account Manipulation Create or Modify System Process Event Triggered Execution Boot or Logon Autostart Execution

Stealth

Obfuscated Files or Information Masquerading Process Injection Indicator Removal Valid Accounts Deobfuscate/Decode Files or Information Traffic Signaling System Binary Proxy Execution Execution Guardrails Virtualization/Sandbox Evasion Hide Artifacts Reflective Code Loading Delay Execution Social Engineering

Defense Impairment

Modify Registry Subvert Trust Controls Disable or Modify Tools Disable or Modify System Firewall

Credential Access

OS Credential Dumping Network Sniffing Input Capture Multi-Factor Authentication Interception Steal Web Session Cookie Unsecured Credentials Credentials from Password Stores Adversary-in-the-Middle

Discovery

System Service Discovery Query Registry System Network Configuration Discovery System Owner/User Discovery Network Sniffing Process Discovery System Information Discovery File and Directory Discovery System Time Discovery Browser Information Discovery Virtualization/Sandbox Evasion Software Discovery Local Storage Discovery

Lateral Movement

Remote Services Internal Spearphishing Use Alternate Authentication Material

Collection

Data from Local System Input Capture Data Staged Screen Capture Email Collection Clipboard Data Browser Session Hijacking Adversary-in-the-Middle Archive Collected Data

Command and Control

Application Layer Protocol Web Service Ingress Tool Transfer Data Encoding Traffic Signaling Remote Access Tools Dynamic Resolution

Exfiltration

Automated Exfiltration Exfiltration Over C2 Channel Exfiltration Over Web Service

Impact

Service Stop Financial Theft

Software

Amadey · AppleSeed · BabyShark · Brave Prince · CSPY Downloader · GoBear · Gold Dragon · Gomir · HTTPTroy · KGH_SPY · Mimikatz · NOKKI · PsExec · QuasarRAT · TRANSLATEXT · Troll Stealer · certutil · gh0st RAT · schtasks

MITRE ATT&CK All threat actors