Skip to content

Higaisa

Higaisa is a threat group suspected to have South Korean origins. Higaisa has targeted government, public, and trade organizations in North Korea; however, they have also carried out attacks in China, Japan, Russia, Poland, and other nations. Higaisa was first disclosed in early 2019 but is assessed to have operated as early as 2009.

ATT&CK ID: G0126
Origin: South Korea
Techniques: 24
Tools: 3

Vulnerabilities it has exploited

CVE-2018-0798 Microsoft OfficeUnscored · exploited in the wild

Techniques

Initial Access

Execution

Scheduled Task/Job Command and Scripting Interpreter Native API Exploitation for Client Execution User Execution Hijack Execution Flow

Persistence

Scheduled Task/Job Boot or Logon Autostart Execution

Privilege Escalation

Scheduled Task/Job Boot or Logon Autostart Execution

Stealth

Obfuscated Files or Information Masquerading Deobfuscate/Decode Files or Information XSL Script Processing Hide Artifacts Hijack Execution Flow

Discovery

System Network Configuration Discovery Process Discovery System Information Discovery System Time Discovery Local Storage Discovery

Command and Control

Data Obfuscation Application Layer Protocol Proxy Encrypted Channel

Exfiltration

Scheduled Transfer Exfiltration Over C2 Channel

Software

PlugX · certutil · gh0st RAT

MITRE ATT&CK All threat actors