Live Active security incident? Get immediate response
MITRE ATT&CK® Group

G0094: Kimsuky

Kimsuky is a Democratic People's Republic of Korea (DPRK)-based cyber espionage group that has been active since at least 2012. The group initially targeted South Korean government agencies, think tanks, and subject-matter experts in various fields. Its operations expanded to include the United Nations and organizations in the government, education, business services, and manufacturing sectors across the United States, Japan, Russia, and Europe. Kimsuky has focused collection on foreign policy and national security issues tied to the Korean Peninsula, nuclear policy, and sanctions. Kimsuky operations have overlapped with those of other North Korean state-sponsored cyber espionage actors as a result of ad hoc collaborations or other limited resource sharing.[1][2][3][4][5][6]

Kimsuky was assessed to be responsible for the 2014 Korea Hydro & Nuclear Power Co. compromise; other notable campaigns include Operation STOLEN PENCIL (2018), Operation Kabar Cobra (2019), and Operation Smoke Screen (2019).[7][8][9] In 2023, Kimsuky was observed using commercial large language models (LLMs) to assist with vulnerability research, scripting, social engineering and reconnaissance.[10]

DPRK threat actor cluster boundaries overlap in open source reporting, with some security researchers consolidating all attributed North Korean state-sponsored cyber activity under Lazarus Group, rather than tracking operationally distinct subgroups.

EnterpriseG0094GroupObject v5.2 Modified
Discuss defensive coverage Back to ATT&CK
Glexia's Take

Analyst context for executives and security teams

Analyst confidence Medium

Kimsuky matters because MITRE describes it as a DPRK-based cyber espionage group with long-running collection interests around Korean Peninsula policy, nuclear policy, sanctions, and related government, academic, business services, manufacturing, and international organization targets. For leaders, this is less about a single malware family and more about whether the organization can detect credential theft, remote access tooling, data collection, and abuse of legitimate administration utilities across Windows, Linux, macOS, Android, and browser-adjacent activity where those assets exist.

Executive priority

Prioritize this as an intelligence-led readiness issue for organizations connected to government, policy, education, manufacturing, business services, sanctions, nuclear policy, or Korea-related work. Executive questions should focus on: whether sensitive research and policy data is mapped and monitored; whether identity protections can withstand credential dumping and remote access abuse; whether SOC coverage includes legitimate tools such as PsExec, schtasks, and certutil; and whether incident response plans account for espionage-driven dwell time rather than only disruptive events. The Korea Hydro & Nuclear Power Co. reference also makes this relevant to organizations with cyber-physical or critical infrastructure dependencies, while still requiring local evidence before assuming operational technology exposure.

Technical view

MITRE does not provide a dedicated detection section for this group, so coverage should be built from the relationships. Kimsuky is linked to credential access via LSASS Memory, local data collection, system service discovery, remote access/backdoor tooling, information stealers, downloaders, and legitimate utilities including Mimikatz, PsExec, schtasks, and certutil. SOC and IR teams should validate detections for credential dumping attempts, suspicious service or scheduled task activity, anomalous remote execution, unexpected certificate utility usage, RAT/backdoor network behavior, browser extension masquerading, and Linux/Android visibility where related malware platforms are in scope.

Likely telemetry

  • Endpoint process creation and command-line logs for Windows, Linux, and macOS where available
  • Windows security, EDR, and memory-access telemetry related to LSASS access or credential dumping behavior
  • Service creation, remote execution, and administrative tool usage logs, especially around PsExec-like activity
  • Scheduled task creation and modification telemetry, including schtasks usage
  • certutil execution, file download, certificate-related command activity, and associated network connections

Detection direction

  • Treat the ATT&CK group page as threat-intelligence context, not a complete detection package; MITRE provides no official detection text for this object.
  • Map detections to the related techniques and software: LSASS access, local data discovery, service discovery, remote execution, scheduled tasks, certutil abuse, RAT activity, downloaders, and information stealers.
  • Tune carefully for dual-use tools. PsExec, schtasks, and certutil have legitimate administrative uses, so detections should incorporate user role, host criticality, parent process, command-line arguments, execution timing, destination, and change-control context.
  • Validate visibility beyond Windows. The relationship set includes Windows-heavy tooling but also macOS, Linux, and Android platform references through related software; organizations should confirm whether those environments are monitored rather than assuming Windows-only coverage is sufficient.
  • Use alias handling in threat intelligence workflows. The supplied aliases include Black Banshee, Velvet Chollima, Emerald Sleet, THALLIUM, APT43, TA427, Springtail, Earth Kumiho, and PatheticSlug; reporting overlap can affect alert enrichment, case correlation, and executive briefings.

Mitigation priorities

  • Start with identity and credential protections: reduce administrative exposure, limit credential material available on endpoints, and prioritize controls that reduce or detect LSASS access.
  • Harden and monitor legitimate administration paths, including remote execution, service management, scheduled tasks, and certificate utilities, with clear baselines for approved administrative behavior.
  • Apply application control, script control, and endpoint protection policies to reduce execution of unapproved RATs, downloaders, stealers, and masqueraded installers or extensions.
  • Strengthen data protection around sensitive policy, research, sanctions, manufacturing, and government-related information through access review, logging, and data location awareness.
  • Review browser extension governance and endpoint configuration where extension masquerading is a realistic path for the organization.
Analyst notes and limits

This take is based on MITRE ATT&CK G0094 Kimsuky, its official description, aliases, external references, and supplied relationships to software and techniques. The relationship set is especially useful for defensive planning because it shows a mix of credential access, discovery, collection, legitimate tool abuse, remote access malware, stealers, and platform breadth. The Stolen Pencil revoked-by relationship should be handled as historical consolidation context rather than a separate current group assumption.

The object does not specify platforms or tactics at the group level and provides no official detection guidance. Some related descriptions are truncated in the supplied data. Local asset inventory, business relevance to the stated target themes, and available telemetry are required before concluding exposure, coverage, or incident likelihood.

Official MITRE ATT&CK definition

Kimsuky

Kimsuky is a Democratic People's Republic of Korea (DPRK)-based cyber espionage group that has been active since at least 2012. The group initially targeted South Korean government agencies, think tanks, and subject-matter experts in various fields. Its operations expanded to include the United Nations and organizations in the government, education, business services, and manufacturing sectors across the United States, Japan, Russia, and Europe. Kimsuky has focused collection on foreign policy and national security issues tied to the Korean Peninsula, nuclear policy, and sanctions. Kimsuky operations have overlapped with those of other North Korean state-sponsored cyber espionage actors as a result of ad hoc collaborations or other limited resource sharing.[1][2][3][4][5][6]

Kimsuky was assessed to be responsible for the 2014 Korea Hydro & Nuclear Power Co. compromise; other notable campaigns include Operation STOLEN PENCIL (2018), Operation Kabar Cobra (2019), and Operation Smoke Screen (2019).[7][8][9] In 2023, Kimsuky was observed using commercial large language models (LLMs) to assist with vulnerability research, scripting, social engineering and reconnaissance.[10]

DPRK threat actor cluster boundaries overlap in open source reporting, with some security researchers consolidating all attributed North Korean state-sponsored cyber activity under Lazarus Group, rather than tracking operationally distinct subgroups.

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

69 rows
Domain ID Name Relationship / procedure
Enterprise T1678 Delay Execution

Kimsuky has utilized the Sleep function to ensure execution of scripts.CitationGen Digital Kimsuky HTTPTroy October 2025CitationAryaka Kimsuky July 2025
Enterprise T1005 Data from Local System

Kimsuky has collected Office, PDF, and HWP documents from its victims.CitationSecurelist Kimsuky Sept 2013CitationTalos Kimsuky Nov 2021 Kimsuky has also harvested victim files through the use of the `RecentFiles()` function that collects paths of recently accessed files by parsing .lnk shortcuts from `%APPDATA%\Microsoft\Windows\Recent`.CitationAryaka Kimsuky July 2025
Enterprise T1587.001 Malware Sub-technique

Kimsuky has developed its own unique malware such as MailFetch.py for use in operations.CitationKISA Operation MuzabiCitationTalos Kimsuky Nov 2021CitationMandiant APT43 March 2024
Enterprise T1583 Acquire Infrastructure

Kimsuky has used funds from stolen and laundered cryptocurrency to acquire operational infrastructure.CitationMandiant APT43 March 2024
Enterprise T1021.001 Remote Desktop Protocol Sub-technique

Kimsuky has used RDP for direct remote point-and-click access.CitationNetscout Stolen Pencil Dec 2018
Enterprise T1585.002 Email Accounts Sub-technique

Kimsuky has created email accounts for phishing operations.CitationKISA Operation MuzabiCitationMandiant APT43 March 2024CitationProofpoint TA427 April 2024
Enterprise T1566 Phishing

Kimsuky has used spearphishing to gain initial access and intelligence.CitationMSFT-AICitationMandiant APT43 March 2024
Enterprise T1685 Disable or Modify Tools

Kimsuky has been observed turning off Windows Security Center and can hide the AV software window from the view of the infected user.CitationSecurelist Kimsuky Sept 2013CitationTalos Kimsuky Nov 2021
Enterprise T1204.002 Malicious File Sub-technique

Kimsuky has used spearphishing attachments to entice victims into opening malicious files, including LNK files disguised with tailored filenames and fake extensions.CitationThreatConnect Kimsuky September 2020CitationVirusBulletin Kimsuky October 2019CitationCISA AA20-301A KimsukyCitationCybereason Kimsuky November 2020CitationMalwarebytes Kimsuky June 2021CitationTalos Kimsuky Nov 2021CitationNaumaanProofpoint_GlobalClickFix_April2025 Kimsuky has also delivered malicious payloads within archive files (e.g., ZIP), which display decoy documents upon execution while running malicious code in the background.CitationGen Digital Kimsuky HTTPTroy October 2025
Enterprise T1040 Network Sniffing

Kimsuky has used the Nirsoft SniffPass network sniffer to obtain passwords sent over non-secure protocols.CitationCISA AA20-301A KimsukyCitationNetscout Stolen Pencil Dec 2018
Enterprise T1566.002 Spearphishing Link Sub-technique

Kimsuky has sent spearphishing emails containing a link to a document that contained malicious macros or took the victim to an actor-controlled domain.CitationEST Kimsuky April 2019CitationNetscout Stolen Pencil Dec 2018CitationKISA Operation Muzabi
Enterprise T1056.003 Web Portal Capture Sub-technique

Kimsuky has collected credentials from a fake Google account login page.CitationFBI_KimsukyQR_Jan2026
Enterprise T1539 Steal Web Session Cookie

Kimsuky has used malware, such as TRANSLATEXT, to steal and exfiltrate browser cookies.CitationZscaler Kimsuky TRANSLATEXTCitationS2W Troll Stealer 2024
Enterprise T1588.002 Tool Sub-technique

Kimsuky has obtained and used tools such as Nirsoft WebBrowserPassVIew, Mimikatz, and PsExec.CitationNetscout Stolen Pencil Dec 2018CitationTalos Kimsuky Nov 2021CitationMandiant APT43 March 2024
Enterprise T1078.003 Local Accounts Sub-technique

Kimsuky has used a tool called GREASE to add a Windows admin account in order to allow them continued access via RDP.CitationNetscout Stolen Pencil Dec 2018
Enterprise T1020 Automated Exfiltration

Kimsuky has exfiltrated data to C2 servers using an automated script that executes every 10 minutes and after successful checks for the presence of pre-designated staged filenames.CitationAryaka Kimsuky July 2025
Enterprise T1140 Deobfuscate/Decode Files or Information

Kimsuky has decoded malicious VBScripts using Base64.CitationTalos Kimsuky Nov 2021 Kimsuky has also decoded malicious PowerShell scripts using Base64.CitationSecuronix Kimsuky February 2025CitationAryaka Kimsuky July 2025 Kimsuky has decoded RC4 obfuscated files prior to downloading files from their infrastructure.CitationAryaka Kimsuky July 2025
Enterprise T1204.004 Malicious Copy and Paste Sub-technique

Kimsuky has leveraged ClickFix type tactics enticing victims to copy and paste malicious code.CitationNaumaanProofpoint_GlobalClickFix_April2025
Enterprise T1027.010 Command Obfuscation Sub-technique

Kimsuky has encoded malicious PowerShell scripts using Base64.CitationSecuronix Kimsuky February 2025
Enterprise T1608.001 Upload Malware Sub-technique

Kimsuky has used compromised and acquired infrastructure to host and deliver malware including Blogspot to host beacons, file exfiltrators, and implants.CitationTalos Kimsuky Nov 2021CitationMandiant APT43 March 2024 Kimsuky has also hosted malicious payloads on Dropbox.CitationSecuronix Kimsuky February 2025
Enterprise T1105 Ingress Tool Transfer

Kimsuky has downloaded additional scripts, tools, and malware onto victim systems.CitationTalos Kimsuky Nov 2021CitationCrowdstrike GTR2020 Mar 2020CitationSecuronix Kimsuky February 2025CitationAryaka Kimsuky July 2025
Enterprise T1587 Develop Capabilities

Kimsuky created and used a mailing toolkit to use in spearphishing attacks.CitationVirusBulletin Kimsuky October 2019
Enterprise T1567.002 Exfiltration to Cloud Storage Sub-technique

Kimsuky has exfiltrated stolen files and data to actor-controlled Blogspot accounts.CitationTalos Kimsuky Nov 2021 Kimsuky has also leveraged Dropbox for uploading victim system information.CitationSecuronix Kimsuky February 2025
Enterprise T1598 Phishing for Information

Kimsuky has used tailored spearphishing emails to gather victim information including contat lists to identify additional targets.CitationMandiant APT43 March 2024
Enterprise T1684.001 Impersonation Sub-technique

Kimsuky has also impersonated legitimate people, such as a foreign advisor, an embassy employee, and a think tank employee.CitationFBI_KimsukyQR_Jan2026 Kimsuky has also purported to be a Japanese diplomat to communicate with the victims.CitationNaumaanProofpoint_GlobalClickFix_April2025
Enterprise T1553.002 Code Signing Sub-technique

Kimsuky has signed files with the name EGIS CO,. Ltd. and has stolen a valid certificate that is used to sign the malware and the dropper.CitationThreatConnect Kimsuky September 2020CitationS2W Troll Stealer 2024
Enterprise T1036.004 Masquerade Task or Service Sub-technique

Kimsuky has disguised services to appear as benign software or related to operating system functions.CitationCISA AA20-301A KimsukyCitationSecuronix Kimsuky February 2025
Enterprise T1115 Clipboard Data

Kimsuky has the ability to steal data from the clipboard.CitationAryaka Kimsuky July 2025
Enterprise T1559.001 Component Object Model Sub-technique

Kimsuky has leveraged Component Object Model (COM) to create scheduled tasks to include using naming conventions that mimic legitimate applications.CitationGen Digital Kimsuky HTTPTroy October 2025 Kimsuky has leveraged obfuscation VBScript to form a string in `WScript.Shell` which has downloaded a malicious payload to the victim environment.CitationAryaka Kimsuky July 2025
Enterprise T1102.002 Bidirectional Communication Sub-technique

Kimsuky has used Blogspot pages and a Github repository for C2.CitationTalos Kimsuky Nov 2021CitationZscaler Kimsuky TRANSLATEXT Kimsuky has also leveraged Dropbox for downloading payloads and uploading victim system information.CitationSecuronix Kimsuky February 2025
Enterprise T1489 Service Stop

Kimsuky has disabled actively running virtual environments using the `KillMe` function to include VMware, Microsoft Hypervisors, and VirtualBox.CitationAryaka Kimsuky July 2025
Enterprise T1217 Browser Information Discovery

Kimsuky has collected sensitive browser data using the function `GetBrowserData()` to include login credentials, bookmarks, cookies, and encryption keys.CitationAryaka Kimsuky July 2025
Enterprise T1204.001 Malicious Link Sub-technique

Kimsuky has lured victims into clicking malicious links.CitationKISA Operation Muzabi
Enterprise T1534 Internal Spearphishing

Kimsuky has sent internal spearphishing emails for lateral movement after stealing victim information.CitationKISA Operation Muzabi
Enterprise T1190 Exploit Public-Facing Application

Kimsuky has exploited various vulnerabilities for initial access, including Microsoft Exchange vulnerability CVE-2020-0688.CitationKISA Operation Muzabi
Enterprise T1593.001 Social Media Sub-technique

Kimsuky has used Twitter to monitor potential victims and to prepare targeted phishing e-mails.CitationMalwarebytes Kimsuky June 2021
Enterprise T1027.007 Dynamic API Resolution Sub-technique

Kimsuky has leveraged dynamic API resolution using custom hashing techniques.CitationGen Digital Kimsuky HTTPTroy October 2025
Enterprise T1027.013 Encrypted/Encoded File Sub-technique

Kimsuky has obfuscated code within files by converting hexadecimal strings to decimal numbers using the `CLng function` in combination with processing arithmetic operations and leveraging the `Chr function` to generate readable characters.CitationAryaka Kimsuky July 2025 Kimsuky has also encoded files with Base64 and RC4.CitationAryaka Kimsuky July 2025 Kimsuky has utilized XOR and RC4 to encode malicious payloads.CitationGen Digital Kimsuky HTTPTroy October 2025
Enterprise T1585 Establish Accounts

Kimsuky has leveraged stolen PII to create accounts.CitationMandiant APT43 March 2024
Enterprise T1589.003 Employee Names Sub-technique

Kimsuky has collected victim employee name information.CitationKISA Operation Muzabi
Enterprise T1218.011 Rundll32 Sub-technique

Kimsuky has used `rundll32.exe` to execute malicious scripts and malware on a victim's network.CitationTalos Kimsuky Nov 2021CitationAryaka Kimsuky July 2025
Enterprise T1564.002 Hidden Users Sub-technique

Kimsuky has run reg add ‘HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList’ /v to hide a newly created user.CitationKISA Operation Muzabi
Enterprise T1176.001 Browser Extensions Sub-technique

Kimsuky has used Google Chrome browser extensions to infect victims and to steal passwords and cookies.CitationZdnet Kimsuky Dec 2018CitationNetscout Stolen Pencil Dec 2018
Enterprise T1070.004 File Deletion Sub-technique

Kimsuky has deleted the exfiltrated data on disk after transmission. Kimsuky has also used an instrumentor script to terminate browser processes running on an infected system and then delete the cookie files on disk.CitationSecurelist Kimsuky Sept 2013CitationTalos Kimsuky Nov 2021CitationKISA Operation Muzabi Kimsuky has deleted files using the `Remove-Item` PowerShell commandlet to remove traces of executed payloads.CitationSecuronix Kimsuky February 2025 Kimsuky has also removed remnants of files used for delivery to include .log and .zip files.CitationAryaka Kimsuky July 2025
Enterprise T1219.002 Remote Desktop Software Sub-technique

Kimsuky has used a modified TeamViewer client as a command and control channel.CitationSecurelist Kimsuky Sept 2013CitationCrowdstrike GTR2020 Mar 2020
Enterprise T1583.004 Server Sub-technique

Kimsuky has purchased hosting servers with virtual currency and prepaid cards.CitationKISA Operation Muzabi
Enterprise T1552.004 Private Keys Sub-technique

Kimsuky has accessed a Local State files associated with Chromium-based browsers that contain the AES key used to encrypt passwords stored in the browser to include `app_bound_encrypted_key`.CitationAryaka Kimsuky July 2025
Enterprise T1620 Reflective Code Loading

Kimsuky has used the Invoke-Mimikatz PowerShell script to reflectively load a Mimikatz credential stealing DLL into memory.CitationMandiant APT43 March 2024 Kimsuky has also used reflective loading through .NET assembly using `[System.Reflection.Assembly]::Load`.CitationSecuronix Kimsuky February 2025
Enterprise T1111 Multi-Factor Authentication Interception

Kimsuky has used a proprietary tool to intercept one time passwords required for two-factor authentication.CitationKISA Operation Muzabi
Enterprise T1594 Search Victim-Owned Websites

Kimsuky has searched for information on the target company's website.CitationKISA Operation Muzabi
Enterprise T1059.003 Windows Command Shell Sub-technique

Kimsuky has executed Windows commands by using `cmd` and running batch scripts.CitationTalos Kimsuky Nov 2021CitationKISA Operation Muzabi Kimsuky has also used `cmd.exe` to automatically open downloaded decoy pdf documents with the system’s default PDF viewer.CitationAryaka Kimsuky July 2025 Kimsuky has utilized malicious payloads to create reverse shells within the victim environment.CitationGen Digital Kimsuky HTTPTroy October 2025 Kimsuky has also used batch scripts to eventually run QuasarRAT.CitationNaumaanProofpoint_GlobalClickFix_April2025
Enterprise T1583.001 Domains Sub-technique

Kimsuky has registered domains to spoof targeted organizations and trusted third parties including search engines, web platforms, and cryptocurrency exchanges.CitationThreatConnect Kimsuky September 2020CitationZdnet Kimsuky Group September 2020CitationCISA AA20-301A KimsukyCitationCybereason Kimsuky November 2020CitationMalwarebytes Kimsuky June 2021CitationKISA Operation MuzabiCitationMandiant APT43 March 2024
Enterprise T1012 Query Registry

Kimsuky has obtained specific Registry keys and values on a compromised host.CitationTalos Kimsuky Nov 2021
Enterprise T1591 Gather Victim Org Information

Kimsuky has collected victim organization information including but not limited to organization hierarchy, functions, press releases, and others.CitationKISA Operation Muzabi Kimsuky has also used large language models (LLMs) to gather information about potential targets of interest.CitationMSFT-AI
Enterprise T1071.001 Web Protocols Sub-technique

Kimsuky has used HTTP GET and POST requests for C2.CitationTalos Kimsuky Nov 2021CitationAryaka Kimsuky July 2025
Enterprise T1585.001 Social Media Accounts Sub-technique

Kimsuky has created social media accounts to monitor news and security trends as well as potential targets.CitationKISA Operation Muzabi
Enterprise T1657 Financial Theft

Kimsuky has stolen and laundered cryptocurrency to self-fund operations including the acquisition of infrastructure.CitationMandiant APT43 March 2024
Enterprise T1136.001 Local Account Sub-technique

Kimsuky has created accounts with net user.CitationKISA Operation Muzabi
Enterprise T1007 System Service Discovery

Kimsuky has used an instrumentor script to gather the names of all services running on a victim's system.CitationTalos Kimsuky Nov 2021
Enterprise T1568 Dynamic Resolution

Kimsuky has used Dynamic DNS (DDNS) services, such as FreeDNS or No-IP DDNS, to include servers located in South Korea.CitationNaumaanProofpoint_GlobalClickFix_April2025
Enterprise T1027.001 Binary Padding Sub-technique

Kimsuky has performed padding of PowerShell command line code with over 100 spaces.CitationSecuronix Kimsuky February 2025
Enterprise T1586.002 Email Accounts Sub-technique

Kimsuky has compromised email accounts to send spearphishing e-mails.CitationVirusBulletin Kimsuky October 2019CitationMalwarebytes Kimsuky June 2021
Enterprise T1560.003 Archive via Custom Method Sub-technique

Kimsuky has used RC4 encryption before exfil.CitationSecurelist Kimsuky Sept 2013
Enterprise T1070.006 Timestomp Sub-technique

Kimsuky has manipulated timestamps for creation or compilation dates to defeat anti-forensics.CitationCybereason Kimsuky November 2020
Enterprise T1598.003 Spearphishing Link Sub-technique

Kimsuky has used links in e-mail to steal account information including web beacons for target profiling.CitationVirusBulletin Kimsuky October 2019CitationMalwarebytes Kimsuky June 2021CitationKISA Operation MuzabiCitationProofpoint TA427 April 2024 Kimsuky has also utilized QR codes (also known as Quishing) to direct victims to malicious links through the reliance of a mobile device to scan a code with an embedded malicious URL.CitationEnkiWhiteHat_KimsukyDOCSWAP_Dec2025CitationFBI_KimsukyQR_Jan2026
Enterprise T1027.012 LNK Icon Smuggling Sub-technique

Kimsuky has used the LNK icon location to execute malicious scripts.CitationAryaka Kimsuky July 2025 Kimsuky has also padded the LNK target field properties with extra spaces to obscure the script.CitationSecuronix Kimsuky February 2025
Enterprise T1596 Search Open Technical Databases

Kimsuky has used LLMs to better understand publicly reported vulnerabilities.CitationMSFT-AICitationOpenAI-CTI
Enterprise T1027.016 Junk Code Insertion Sub-technique

Kimsuky has obfuscated code by filling scripts with junk code and concatenating strings to hamper analysis and detection.CitationSecuronix Kimsuky February 2025
Enterprise T1550.002 Pass the Hash Sub-technique

Kimsuky has used pass the hash for authentication to remote access software used in C2.CitationCISA AA20-301A Kimsuky
Associated objects

Groups, software, and campaigns

Group Enterprise

G0086: Stolen Pencil

Stolen Pencil is a threat group likely originating from DPRK that has been active since at least May 2018. The group appears to have targeted academic institutions, but its motives remain unclear.[1]

Revoked/deprecated
Malware Enterprise

S9007: HTTPTroy

HTTPTroy is a highly obfuscated backdoor that facilitates collection, command and control, defense evasion and exfiltration. HTTPTroy was first reported in October 2025. HTTPTroy has been observed in operations attributed to DPRK-affiliated threat actors, including Kimsuky. HTTPTroy has been delivered to victims through a separate loader leveraged by Kimsuky.[1]

Windows
Tool Enterprise

S0111: schtasks

schtasks is used to schedule execution of programs or scripts on a Windows system to run at a specific date and time. [1]

Windows
Tool Enterprise

S0160: certutil

certutil is a command-line utility that can be used to obtain certificate authority information and configure Certificate Services. [1]

Windows
Relationship explorer

All related ATT&CK context

uses · Technique T1678: Delay Execution Enterprise uses · Technique T1005: Data from Local System Enterprise uses · Technique T1587.001: Malware Enterprise uses · Technique T1583: Acquire Infrastructure Enterprise uses · Malware S1196: Troll Stealer Enterprise uses · Technique T1021.001: Remote Desktop Protocol Enterprise uses · Technique T1585.002: Email Accounts Enterprise uses · Technique T1566: Phishing Enterprise uses · Technique T1685: Disable or Modify Tools Enterprise uses · Technique T1204.002: Malicious File Enterprise uses · Technique T1040: Network Sniffing Enterprise uses · Technique T1566.002: Spearphishing Link Enterprise uses · Technique T1056.003: Web Portal Capture Enterprise uses · Technique T1539: Steal Web Session Cookie Enterprise uses · Technique T1588.002: Tool Enterprise uses · Technique T1078.003: Local Accounts Enterprise uses · Malware S9007: HTTPTroy Enterprise uses · Technique T1020: Automated Exfiltration Enterprise uses · Technique T1140: Deobfuscate/Decode Files or Information Enterprise uses · Technique T1204.004: Malicious Copy and Paste Enterprise uses · Technique T1027.010: Command Obfuscation Enterprise uses · Technique T1608.001: Upload Malware Enterprise uses · Technique T1105: Ingress Tool Transfer Enterprise uses · Technique T1587: Develop Capabilities Enterprise
Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates .

ATT&CK release
19.1
Object version
5.2
Created
Modified
Raw hash
b37ef7c9ffa98954...
Imported snapshots across ATT&CK releases (1)
Release Bundle imported Object version Modified Status Raw hash
19.1 5.2 Current bundle b37ef7c9ffa9…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSON Open MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    EST Kimsuky April 2019

    Alyac. (2019, April 3). Kimsuky Organization Steals Operation Stealth Power. Retrieved August 13, 2019.

    Open source URL
  2. [2]
    Cybereason Kimsuky November 2020

    Dahan, A. et al. (2020, November 2). Back to the Future: Inside the Kimsuky KGH Spyware Suite. Retrieved November 6, 2020.

    Open source URL
  3. [3]
    Malwarebytes Kimsuky June 2021

    Jazi, H. (2021, June 1). Kimsuky APT continues to target South Korean government using AppleSeed backdoor. Retrieved June 10, 2021.

    Open source URL
  4. [4]
    CISA AA20-301A Kimsuky

    CISA, FBI, CNMF. (2020, October 27). https://us-cert.cisa.gov/ncas/alerts/aa20-301a. Retrieved November 4, 2020.

    Open source URL
  5. [5]
    Mandiant APT43 March 2024

    Mandiant. (2024, March 14). APT43: North Korean Group Uses Cybercrime to Fund Espionage Operations. Retrieved May 3, 2024.

    Open source URL
  6. [6]
    Proofpoint TA427 April 2024

    Lesnewich, G. et al. (2024, April 16). From Social Engineering to DMARC Abuse: TA427’s Art of Information Gathering. Retrieved May 3, 2024.

    Open source URL
  7. [7]
    Netscout Stolen Pencil Dec 2018

    ASERT team. (2018, December 5). STOLEN PENCIL Campaign Targets Academia. Retrieved February 5, 2019.

    Open source URL
  8. [8]
    EST Kimsuky SmokeScreen April 2019

    ESTSecurity. (2019, April 17). Analysis of the APT Campaign ‘Smoke Screen’ targeting to Korea and US 출처: https://blog.alyac.co.kr/2243 [이스트시큐리티 알약 블로그]. Retrieved September 29, 2021.

    Open source URL
  9. [9]
    AhnLab Kimsuky Kabar Cobra Feb 2019

    AhnLab. (2019, February 28). Operation Kabar Cobra - Tenacious cyber-espionage campaign by Kimsuky Group. Retrieved September 29, 2021.

    Open source URL
  10. [10]
    MSFT-AI

    Microsoft Threat Intelligence. (2024, February 14). Staying ahead of threat actors in the age of AI. Retrieved March 11, 2024.

    Open source URL
  11. [11]
    APT43

    (Citation: Mandiant APT43 March 2024)(Citation: Proofpoint TA427 April 2024)

  12. [12]
    Black Banshee

    (Citation: Cybereason Kimsuky November 2020)(Citation: Malwarebytes Kimsuky June 2021)

  13. [13]
    Cloudflare 2026 Threat Report New Threat Actors March 2026

    Cloudflare. (2026, March 3). Introducing the 2026 Cloudflare Threat Report. Retrieved April 18, 2026.

    Open source URL
  14. [14]
    Earth Kumiho

    (Citation: Rapid7 Threat Landscape Actors March 2026)

  15. [15]
    Emerald Sleet

    (Citation: Microsoft Threat Actor Naming July 2023)(Citation: Proofpoint TA427 April 2024)

  16. [16]
    Kimsuky

    (Citation: Securelist Kimsuky Sept 2013)(Citation: Malwarebytes Kimsuky June 2021)

  17. [17]
    Microsoft Threat Actor Naming July 2023

    Microsoft . (2023, July 12). How Microsoft names threat actors. Retrieved November 17, 2023.

    Open source URL
  18. [18]
    PatheticSlug

    (Citation: Cloudflare 2026 Threat Report New Threat Actors March 2026)

  19. [19]
    Rapid7 Threat Landscape Actors March 2026

    Rapid7. (2026, March 18). 2026 GLOBAL THREAT LANDSCAPE REPORT: Decoding the Accelerated Cyber Attack Cycle. Retrieved April 18, 2026.

    Open source URL
  20. [20]
    Securelist Kimsuky Sept 2013

    Tarakanov , D.. (2013, September 11). The “Kimsuky” Operation: A North Korean APT?. Retrieved August 13, 2019.

    Open source URL
  21. [21]
    Springtail

    (Citation: Symantec Troll Stealer 2024)

  22. [22]
    Symantec Troll Stealer 2024

    Symantec Threat Hunter Team. (2024, May 16). Springtail: New Linux Backdoor Added to Toolkit. Retrieved January 17, 2025.

    Open source URL
  23. [23]
    TA427

    (Citation: Proofpoint TA427 April 2024)

  24. [24]
    THALLIUM

    (Citation: Cybereason Kimsuky November 2020)(Citation: Malwarebytes Kimsuky June 2021)(Citation: Mandiant APT43 March 2024)(Citation: Proofpoint TA427 April 2024)

  25. [25]
    ThreatConnect Kimsuky September 2020

    ThreatConnect. (2020, September 28). Kimsuky Phishing Operations Putting In Work. Retrieved October 30, 2020.

    Open source URL
  26. [26]
    Velvet Chollima

    (Citation: Zdnet Kimsuky Dec 2018)(Citation: ThreatConnect Kimsuky September 2020)(Citation: Malwarebytes Kimsuky June 2021)

  27. [27]
    Zdnet Kimsuky Dec 2018

    Cimpanu, C.. (2018, December 5). Cyber-espionage group uses Chrome extension to infect victims. Retrieved August 26, 2019.

    Open source URL
  28. [28]
    mitre-attack G0094
    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK site Official STIX data repository MITRE ATT&CK terms of use