Kimsuky
North KoreaState-sponsoredUnknown
Observation period
130
Techniques
0
Reports
- Latest observed activity
- No dated reports available
- First observed
- —
Profile
This threat actor targets South Korean think tanks, industry, nuclear power operators, and the Ministry of Unification for espionage purposes.
Relevance for Germany, Austria and Switzerland
high
Assessment based on target countries according to MISP Galaxy (CFR Cyber Operations Tracker).
Target sectors according to source
- Government
- Private sector
Target countries according to source Ministry of Unification, Sejong Institute, Korea Institute for Defense Analyses, Germany
Aliases
- Velvet Chollima
- Black Banshee
- Thallium
- Operation Stolen Pencil
- APT43
- Emerald Sleet
- Springtail
- Sparkling Pisces
MITRE ATT&CK techniques
Observed techniques per ATT&CK Enterprise and ICS. Each technique links to the ATT&CK knowledge base.
- T1678
- T1005
- T1587.001
- T1583
- T1021.001
- T1585.002
- T1566
- T1685
- T1204.002
- T1040
- T1566.002
- T1056.003
- T1539
- T1588.002
- T1078.003
- T1020
- T1140
- T1204.004
- T1027.010
- T1608.001
- T1105
- T1587
- T1567.002
- T1598
- T1684.001
- T1553.002
- T1036.004
- T1115
- T1559.001
- T1102.002
- T1489
- T1217
- T1204.001
- T1534
- T1190
- T1593.001
- T1027.007
- T1027.013
- T1585
- T1589.003
- T1218.011
- T1564.002
- T1176.001
- T1070.004
- T1219.002
- T1583.004
- T1552.004
- T1620
- T1111
- T1594
- T1059.003
- T1583.001
- T1012
- T1591
- T1071.001
- T1585.001
- T1657
- T1136.001
- T1007
- T1568
- T1027.001
- T1586.002
- T1560.003
- T1070.006
- T1598.003
- T1027.012
- T1596
- T1027.016
- T1550.002
- T1557
- T1518.001
- T1218.005
- T1041
- T1185
- T1564.011
- T1686
- T1133
- T1082
- T1106
- T1584.001
- T1589.002
- T1059.007
- T1497.001
- T1027
- T1074.001
- T1071.003
- T1056.001
- T1027.002
- T1552.001
- T1102.001
- T1560.001
- T1016
- T1555.003
- T1055.001
- T1546.001
- T1566.001
- T1057
- T1055
- T1113
- T1112
- T1059.001
- T1588.005
- T1218.010
- T1547.001
- T1543.003
- T1583.006
- T1682
- T1083
- T1564.003
- T1027.015
- T1053.005
- T1033
- T1480.002
- T1036.005
- T1132.002
- T1036.007
- T1055.012
- T1588.003
- T1114.003
- T1071.002
- T1003.001
- T1205
- T1059.005
- T1098.007
- T1059.006
- T1505.003
- T1680
- T1114.002
- T1124
- T1593.002
Software / tooling used
External references
- securelist.comsecurelist.com
- cfr.orgcfr.org
- pwc.co.ukpwc.co.uk
- youtu.beyoutu.be
- bloomberglaw.combloomberglaw.com
- netscout.comnetscout.com
- unit42.paloaltonetworks.comunit42.paloaltonetworks.com
- attack.mitre.orgattack.mitre.org
- us-cert.cisa.govus-cert.cisa.gov
- cybereason.comcybereason.com
- mandiant.widen.netmandiant.widen.net
- asec.ahnlab.comasec.ahnlab.com
- asec.ahnlab.comasec.ahnlab.com
- rewterz.comrewterz.com
- sentinelone.comsentinelone.com
- bsi.bund.debsi.bund.de
- ctoatncsc.substack.comctoatncsc.substack.com
- symantec-enterprise-blogs.security.comsymantec-enterprise-blogs.security.com
- unit42.paloaltonetworks.comunit42.paloaltonetworks.com