LiveActive security incident?Get immediate response
MITRE ATT&CK® Group

G0126: Higaisa

Higaisa is a threat group suspected to have South Korean origins. Higaisa has targeted government, public, and trade organizations in North Korea; however, they have also carried out attacks in China, Japan, Russia, Poland, and other nations. Higaisa was first disclosed in early 2019 but is assessed to have operated as early as 2009.[1][2][3]

EnterpriseG0126GroupObject v1.2Modified
Discuss defensive coverageBack to ATT&CK
Glexia's Take · Automated analysis

Security context for executives and security teams

Automation confidenceMedium

Higaisa is an ATT&CK group entry for a suspected South Korean-origin threat group reported against government, public, and trade organizations, especially related to North Korea, with activity also reported in several other countries. The decision value is not a single indicator or platform claim; it is the behavioral pattern: user-driven execution, client-side exploitation, scripting, remote access tools, obfuscation, scheduled persistence/transfer, discovery, and web-like command-and-control. For leaders, this makes Higaisa useful as a validation case for whether the organization can detect and investigate a targeted intrusion that blends common administration, scripting, and web traffic with RAT activity.

Executive priority

Prioritize Higaisa as a control-validation and readiness scenario for targeted intrusion against public-sector, trade, government-adjacent, or geopolitically exposed operations. The ATT&CK relationships point to business-relevant gaps: endpoint visibility for script and command execution, monitoring of scheduled tasks and masqueraded services, egress visibility for web-based or impersonated C2, and investigation readiness for PlugX, gh0st RAT, and certutil-related activity. Executives should ask whether SOC, IR, vulnerability management, and identity/endpoint teams can connect these signals into an incident narrative rather than treating each event as isolated noise.

Technical view

The group object has no official detection text and no platforms listed directly, so validation should be relationship-driven. ATT&CK links Higaisa to PlugX, gh0st RAT, certutil, malicious file execution, client exploitation, Windows command shell, Visual Basic, JavaScript, Native API execution, scheduled tasks, masqueraded tasks/services, process/system/network/time discovery, obfuscation and deobfuscation, web protocols, protocol/service impersonation, internal proxying, scheduled transfer, and exfiltration over C2. SOC teams should test whether endpoint, network, and proxy telemetry can correlate initial file/script execution with follow-on discovery, persistence, RAT-like behavior, and outbound C2-like traffic. Because several related techniques are common in legitimate administration, detections should emphasize unusual parent-child process chains, rare scheduled task names or descriptions, abnormal certutil use, suspicious script execution, unexpected outbound destinations, and timing patterns rather than single-event alerts alone.

Likely telemetry

  • Endpoint process creation and command-line telemetry, especially cmd, scripting engines, certutil, and unusual parent-child process relationships
  • Windows scheduled task and service creation/modification logs, including names, descriptions, paths, and run contexts
  • File creation and modification telemetry for compressed, encoded, padded, or otherwise obfuscated payloads
  • EDR or host telemetry for RAT-like execution patterns associated with PlugX or gh0st RAT where signatures or behavioral analytics are available
  • Network, proxy, DNS, and TLS metadata for web-protocol C2, protocol/service impersonation, unusual beaconing, and outbound traffic to rare destinations

Detection direction

  • Validate correlation across the intrusion chain: malicious file or exploit-driven execution followed by scripting/command shell activity, discovery, persistence, and outbound communications.
  • Tune scheduled task and service detections for masquerading: compare task names, descriptions, binaries, paths, and publishers against known-good baselines to reduce administrator false positives.
  • Review certutil monitoring for decoding, downloading, or handling suspicious artifacts, while accounting for legitimate certificate administration use.
  • Treat web traffic as insufficiently benign by default: inspect proxy/DNS/TLS metadata for rare destinations, periodicity, mismatched protocol behavior, or internal proxy patterns when content inspection is unavailable.
  • Expect obfuscation to weaken hash-only controls; validate behavioral and file-analysis coverage for compressed, encoded, or padded payloads.

Mitigation priorities

  • Start with exposure reduction for client-side execution paths: keep client applications patched and prioritize vulnerability management where user-opened documents or files can lead to code execution.
  • Harden endpoint execution controls around script interpreters, command shell abuse, suspicious document-launched processes, and unnecessary use of administrative utilities.
  • Restrict and monitor scheduled task/service creation to appropriate administrative roles and maintain baselines for legitimate recurring tasks.
  • Improve egress governance with proxy, DNS, and firewall controls that limit direct outbound access and provide logging for web-protocol C2 investigation.
  • Maintain endpoint detection coverage for RAT behavior and for living-off-the-land utility abuse, including certutil where applicable.
Additional notes and limits

This take is based on the official ATT&CK Higaisa group object and its supplied relationships. The strongest defensive value comes from the linked techniques and software rather than the group description alone. The object indicates historical reporting and targeting context, but defenders should avoid assuming local exposure or attribution without corroborating telemetry, intelligence, and incident evidence.

MITRE provides no official detection guidance for this group object, the group object itself lists no platforms or tactics, and the supplied relationships do not include procedure-level details here. Platform references are therefore inferred only from related software and technique records, not from a direct Higaisa platform field. Local baselines, asset exposure, regional/geopolitical relevance, and telemetry quality are required to turn this into detection coverage or risk conclusions.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

Higaisa

Higaisa is a threat group suspected to have South Korean origins. Higaisa has targeted government, public, and trade organizations in North Korea; however, they have also carried out attacks in China, Japan, Russia, Poland, and other nations. Higaisa was first disclosed in early 2019 but is assessed to have operated as early as 2009.[1][2][3]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

28 rows
DomainIDNameRelationship / procedure
EnterpriseT1059.005Visual BasicSub-technique

Higaisa has used VBScript code on the victim's machine.[3]

EnterpriseT1106Native API

Higaisa has called various native OS APIs.[2]

EnterpriseT1041Exfiltration Over C2 Channel

Higaisa exfiltrated data over its C2 channel.[2]

EnterpriseT1574.001DLLSub-technique

Higaisa’s JavaScript file used a legitimate Microsoft Office 2007 package to side-load the OINFO12.OCX dynamic link library.[3]

EnterpriseT1124System Time Discovery

Higaisa used a function to gather the current time.[2]

EnterpriseT1090.001Internal ProxySub-technique

Higaisa discovered system proxy settings and used them if available.[2]

EnterpriseT1204.002Malicious FileSub-technique

Higaisa used malicious e-mail attachments to lure victims into executing LNK files.[1][2]

EnterpriseT1027.013Encrypted/Encoded FileSub-technique

Higaisa used Base64 encoded compressed payloads.[1][2]

EnterpriseT1053.005Scheduled TaskSub-technique

Higaisa dropped and added officeupdate.exe to scheduled tasks.[1][2]

EnterpriseT1082System Information Discovery

Higaisa collected the system GUID and computer name.[3][1]

EnterpriseT1566.001Spearphishing AttachmentSub-technique

Higaisa has sent spearphishing emails containing malicious attachments.[1][2]

EnterpriseT1071.001Web ProtocolsSub-technique

Higaisa used HTTP and HTTPS to send data back to its C2 server.[1][2]

EnterpriseT1001.003Protocol or Service ImpersonationSub-technique

Higaisa used a FakeTLS session for C2 communications.[2]

EnterpriseT1203Exploitation for Client Execution

Higaisa has exploited CVE-2018-0798 for execution.[3]

EnterpriseT1029Scheduled Transfer

Higaisa sent the victim computer identifier in a User-Agent string back to the C2 server every 10 minutes.[3]

EnterpriseT1059.007JavaScriptSub-technique

Higaisa used JavaScript to execute additional files.[1][2][3]

EnterpriseT1027.001Binary PaddingSub-technique

Higaisa performed padding with null bytes before calculating its hash.[2]

EnterpriseT1027.015CompressionSub-technique

Higaisa used Base64 encoded compressed payloads.[1][2]

EnterpriseT1220XSL Script Processing

Higaisa used an XSL file to run VBScript code.[3]

EnterpriseT1564.003Hidden WindowSub-technique

Higaisa used a payload that creates a hidden window.[3]

EnterpriseT1573.001Symmetric CryptographySub-technique

Higaisa used AES-128 to encrypt C2 traffic.[2]

EnterpriseT1680Local Storage Discovery

Higaisa collected the system volume serial number.[3][1]

EnterpriseT1547.001Registry Run Keys / Startup FolderSub-technique

Higaisa added a spoofed binary to the start-up folder for persistence.[1][2]

EnterpriseT1057Process Discovery

Higaisa’s shellcode attempted to find the process ID of the current process.[2]

EnterpriseT1036.004Masquerade Task or ServiceSub-technique

Higaisa named a shellcode loader binary svchast.exe to spoof the legitimate svchost.exe.[1][2]

EnterpriseT1016System Network Configuration Discovery

Higaisa used ipconfig to gather network configuration information.[1][2]

EnterpriseT1059.003Windows Command ShellSub-technique

Higaisa used cmd.exe for execution.[1][2][3]

EnterpriseT1140Deobfuscate/Decode Files or Information

Higaisa used certutil to decode Base64 binaries at runtime and a 16-byte XOR key to decrypt data.[1][2]

Associated objects

Groups, software, and campaigns

ToolEnterprise

S0160: certutil

certutil is a command-line utility that can be used to obtain certificate authority information and configure Certificate Services. [1]

Windows
Relationship explorer

All related ATT&CK context

uses · TechniqueT1059.005: Visual BasicEnterpriseuses · TechniqueT1106: Native APIEnterpriseuses · TechniqueT1041: Exfiltration Over C2 ChannelEnterpriseuses · MalwareS0013: PlugXEnterpriseuses · TechniqueT1574.001: DLLEnterpriseuses · TechniqueT1124: System Time DiscoveryEnterpriseuses · TechniqueT1090.001: Internal ProxyEnterpriseuses · TechniqueT1204.002: Malicious FileEnterpriseuses · TechniqueT1027.013: Encrypted/Encoded FileEnterpriseuses · TechniqueT1053.005: Scheduled TaskEnterpriseuses · TechniqueT1082: System Information DiscoveryEnterpriseuses · TechniqueT1566.001: Spearphishing AttachmentEnterpriseuses · ToolS0160: certutilEnterpriseuses · TechniqueT1071.001: Web ProtocolsEnterpriseuses · TechniqueT1001.003: Protocol or Service ImpersonationEnterpriseuses · TechniqueT1203: Exploitation for Client ExecutionEnterpriseuses · TechniqueT1029: Scheduled TransferEnterpriseuses · TechniqueT1059.007: JavaScriptEnterpriseuses · TechniqueT1027.001: Binary PaddingEnterpriseuses · TechniqueT1027.015: CompressionEnterpriseuses · TechniqueT1220: XSL Script ProcessingEnterpriseuses · TechniqueT1564.003: Hidden WindowEnterpriseuses · TechniqueT1573.001: Symmetric CryptographyEnterpriseuses · TechniqueT1680: Local Storage DiscoveryEnterprise
Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release
19.1
Object version
1.2
Created
Modified
Raw hash
df717a491055f28d...
Imported snapshots across ATT&CK releases(1)
ReleaseBundle importedObject versionModifiedStatusRaw hash
19.11.2Current bundledf717a491055…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSONOpen MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    Malwarebytes Higaisa 2020

    Malwarebytes Threat Intelligence Team. (2020, June 4). New LNK attack tied to Higaisa APT discovered. Retrieved March 2, 2021.

    Open source URL
  2. [2]
    Zscaler Higaisa 2020

    Singh, S. Singh, A. (2020, June 11). The Return on the Higaisa APT. Retrieved March 2, 2021.

    Open source URL
  3. [3]
    PTSecurity Higaisa 2020

    PT ESC Threat Intelligence. (2020, June 4). COVID-19 and New Year greetings: an investigation into the tools and methods used by the Higaisa group. Retrieved March 2, 2021.

    Open source URL
  4. [4]
    Malwarebytes Higaisa 2020

    Malwarebytes Threat Intelligence Team. (2020, June 4). New LNK attack tied to Higaisa APT discovered. Retrieved March 2, 2021.

    Open source URL
  5. [5]
    Malwarebytes Higaisa 2020

    Malwarebytes Threat Intelligence Team. (2020, June 4). New LNK attack tied to Higaisa APT discovered. Retrieved March 2, 2021.

    Open source URL
  6. [6]
    PTSecurity Higaisa 2020

    PT ESC Threat Intelligence. (2020, June 4). COVID-19 and New Year greetings: an investigation into the tools and methods used by the Higaisa group. Retrieved March 2, 2021.

    Open source URL
  7. [7]
    PTSecurity Higaisa 2020

    PT ESC Threat Intelligence. (2020, June 4). COVID-19 and New Year greetings: an investigation into the tools and methods used by the Higaisa group. Retrieved March 2, 2021.

    Open source URL
  8. [8]
    Zscaler Higaisa 2020

    Singh, S. Singh, A. (2020, June 11). The Return on the Higaisa APT. Retrieved March 2, 2021.

    Open source URL
  9. [9]
    Zscaler Higaisa 2020

    Singh, S. Singh, A. (2020, June 11). The Return on the Higaisa APT. Retrieved March 2, 2021.

    Open source URL
  10. [10]
    mitre-attackG0126
    Open source URL
  11. [11]
    mitre-attackG0126
    Open source URL
  12. [12]
    mitre-attackG0126
    Open source URL
  13. [13]
    PTSecurity Higaisa 2020

    PT ESC Threat Intelligence. (2020, June 4). COVID-19 and New Year greetings: an investigation into the tools and methods used by the Higaisa group. Retrieved March 2, 2021.

    Open source URL
  14. [14]
    PTSecurity Higaisa 2020

    PT ESC Threat Intelligence. (2020, June 4). COVID-19 and New Year greetings: an investigation into the tools and methods used by the Higaisa group. Retrieved March 2, 2021.

    Open source URL
  15. [15]
    Zscaler Higaisa 2020

    Singh, S. Singh, A. (2020, June 11). The Return on the Higaisa APT. Retrieved March 2, 2021.

    Open source URL
  16. [16]
    Zscaler Higaisa 2020

    Singh, S. Singh, A. (2020, June 11). The Return on the Higaisa APT. Retrieved March 2, 2021.

    Open source URL
  17. [17]
    Zscaler Higaisa 2020

    Singh, S. Singh, A. (2020, June 11). The Return on the Higaisa APT. Retrieved March 2, 2021.

    Open source URL
  18. [18]
    Zscaler Higaisa 2020

    Singh, S. Singh, A. (2020, June 11). The Return on the Higaisa APT. Retrieved March 2, 2021.

    Open source URL
  19. [19]
    Malwarebytes Higaisa 2020

    Malwarebytes Threat Intelligence Team. (2020, June 4). New LNK attack tied to Higaisa APT discovered. Retrieved March 2, 2021.

    Open source URL
  20. [20]
    Malwarebytes Higaisa 2020

    Malwarebytes Threat Intelligence Team. (2020, June 4). New LNK attack tied to Higaisa APT discovered. Retrieved March 2, 2021.

    Open source URL
  21. [21]
    PTSecurity Higaisa 2020

    PT ESC Threat Intelligence. (2020, June 4). COVID-19 and New Year greetings: an investigation into the tools and methods used by the Higaisa group. Retrieved March 2, 2021.

    Open source URL
  22. [22]
    PTSecurity Higaisa 2020

    PT ESC Threat Intelligence. (2020, June 4). COVID-19 and New Year greetings: an investigation into the tools and methods used by the Higaisa group. Retrieved March 2, 2021.

    Open source URL
  23. [23]
    Zscaler Higaisa 2020

    Singh, S. Singh, A. (2020, June 11). The Return on the Higaisa APT. Retrieved March 2, 2021.

    Open source URL
  24. [24]
    Zscaler Higaisa 2020

    Singh, S. Singh, A. (2020, June 11). The Return on the Higaisa APT. Retrieved March 2, 2021.

    Open source URL
  25. [25]
    Zscaler Higaisa 2020

    Singh, S. Singh, A. (2020, June 11). The Return on the Higaisa APT. Retrieved March 2, 2021.

    Open source URL
  26. [26]
    Zscaler Higaisa 2020

    Singh, S. Singh, A. (2020, June 11). The Return on the Higaisa APT. Retrieved March 2, 2021.

    Open source URL
  27. [27]
    Malwarebytes Higaisa 2020

    Malwarebytes Threat Intelligence Team. (2020, June 4). New LNK attack tied to Higaisa APT discovered. Retrieved March 2, 2021.

    Open source URL
  28. [28]
    Malwarebytes Higaisa 2020

    Malwarebytes Threat Intelligence Team. (2020, June 4). New LNK attack tied to Higaisa APT discovered. Retrieved March 2, 2021.

    Open source URL
  29. [29]
    Zscaler Higaisa 2020

    Singh, S. Singh, A. (2020, June 11). The Return on the Higaisa APT. Retrieved March 2, 2021.

    Open source URL
  30. [30]
    Zscaler Higaisa 2020

    Singh, S. Singh, A. (2020, June 11). The Return on the Higaisa APT. Retrieved March 2, 2021.

    Open source URL
  31. [31]
    Malwarebytes Higaisa 2020

    Malwarebytes Threat Intelligence Team. (2020, June 4). New LNK attack tied to Higaisa APT discovered. Retrieved March 2, 2021.

    Open source URL
  32. [32]
    Malwarebytes Higaisa 2020

    Malwarebytes Threat Intelligence Team. (2020, June 4). New LNK attack tied to Higaisa APT discovered. Retrieved March 2, 2021.

    Open source URL
  33. [33]
    Zscaler Higaisa 2020

    Singh, S. Singh, A. (2020, June 11). The Return on the Higaisa APT. Retrieved March 2, 2021.

    Open source URL
  34. [34]
    Zscaler Higaisa 2020

    Singh, S. Singh, A. (2020, June 11). The Return on the Higaisa APT. Retrieved March 2, 2021.

    Open source URL
  35. [35]
    Malwarebytes Higaisa 2020

    Malwarebytes Threat Intelligence Team. (2020, June 4). New LNK attack tied to Higaisa APT discovered. Retrieved March 2, 2021.

    Open source URL
  36. [36]
    Malwarebytes Higaisa 2020

    Malwarebytes Threat Intelligence Team. (2020, June 4). New LNK attack tied to Higaisa APT discovered. Retrieved March 2, 2021.

    Open source URL
  37. [37]
    Zscaler Higaisa 2020

    Singh, S. Singh, A. (2020, June 11). The Return on the Higaisa APT. Retrieved March 2, 2021.

    Open source URL
  38. [38]
    Zscaler Higaisa 2020

    Singh, S. Singh, A. (2020, June 11). The Return on the Higaisa APT. Retrieved March 2, 2021.

    Open source URL
  39. [39]
    Malwarebytes Higaisa 2020

    Malwarebytes Threat Intelligence Team. (2020, June 4). New LNK attack tied to Higaisa APT discovered. Retrieved March 2, 2021.

    Open source URL
  40. [40]
    Malwarebytes Higaisa 2020

    Malwarebytes Threat Intelligence Team. (2020, June 4). New LNK attack tied to Higaisa APT discovered. Retrieved March 2, 2021.

    Open source URL
  41. [41]
    PTSecurity Higaisa 2020

    PT ESC Threat Intelligence. (2020, June 4). COVID-19 and New Year greetings: an investigation into the tools and methods used by the Higaisa group. Retrieved March 2, 2021.

    Open source URL
  42. [42]
    PTSecurity Higaisa 2020

    PT ESC Threat Intelligence. (2020, June 4). COVID-19 and New Year greetings: an investigation into the tools and methods used by the Higaisa group. Retrieved March 2, 2021.

    Open source URL
  43. [43]
    Malwarebytes Higaisa 2020

    Malwarebytes Threat Intelligence Team. (2020, June 4). New LNK attack tied to Higaisa APT discovered. Retrieved March 2, 2021.

    Open source URL
  44. [44]
    Malwarebytes Higaisa 2020

    Malwarebytes Threat Intelligence Team. (2020, June 4). New LNK attack tied to Higaisa APT discovered. Retrieved March 2, 2021.

    Open source URL
  45. [45]
    Zscaler Higaisa 2020

    Singh, S. Singh, A. (2020, June 11). The Return on the Higaisa APT. Retrieved March 2, 2021.

    Open source URL
  46. [46]
    Zscaler Higaisa 2020

    Singh, S. Singh, A. (2020, June 11). The Return on the Higaisa APT. Retrieved March 2, 2021.

    Open source URL
  47. [47]
    Malwarebytes Higaisa 2020

    Malwarebytes Threat Intelligence Team. (2020, June 4). New LNK attack tied to Higaisa APT discovered. Retrieved March 2, 2021.

    Open source URL
  48. [48]
    Malwarebytes Higaisa 2020

    Malwarebytes Threat Intelligence Team. (2020, June 4). New LNK attack tied to Higaisa APT discovered. Retrieved March 2, 2021.

    Open source URL
  49. [49]
    PTSecurity Higaisa 2020

    PT ESC Threat Intelligence. (2020, June 4). COVID-19 and New Year greetings: an investigation into the tools and methods used by the Higaisa group. Retrieved March 2, 2021.

    Open source URL
  50. [50]
    PTSecurity Higaisa 2020

    PT ESC Threat Intelligence. (2020, June 4). COVID-19 and New Year greetings: an investigation into the tools and methods used by the Higaisa group. Retrieved March 2, 2021.

    Open source URL
  51. [51]
    Malwarebytes Higaisa 2020

    Malwarebytes Threat Intelligence Team. (2020, June 4). New LNK attack tied to Higaisa APT discovered. Retrieved March 2, 2021.

    Open source URL
  52. [52]
    Malwarebytes Higaisa 2020

    Malwarebytes Threat Intelligence Team. (2020, June 4). New LNK attack tied to Higaisa APT discovered. Retrieved March 2, 2021.

    Open source URL
  53. [53]
    Zscaler Higaisa 2020

    Singh, S. Singh, A. (2020, June 11). The Return on the Higaisa APT. Retrieved March 2, 2021.

    Open source URL
  54. [54]
    Zscaler Higaisa 2020

    Singh, S. Singh, A. (2020, June 11). The Return on the Higaisa APT. Retrieved March 2, 2021.

    Open source URL
  55. [55]
    Zscaler Higaisa 2020

    Singh, S. Singh, A. (2020, June 11). The Return on the Higaisa APT. Retrieved March 2, 2021.

    Open source URL
  56. [56]
    Zscaler Higaisa 2020

    Singh, S. Singh, A. (2020, June 11). The Return on the Higaisa APT. Retrieved March 2, 2021.

    Open source URL
  57. [57]
    PTSecurity Higaisa 2020

    PT ESC Threat Intelligence. (2020, June 4). COVID-19 and New Year greetings: an investigation into the tools and methods used by the Higaisa group. Retrieved March 2, 2021.

    Open source URL
  58. [58]
    PTSecurity Higaisa 2020

    PT ESC Threat Intelligence. (2020, June 4). COVID-19 and New Year greetings: an investigation into the tools and methods used by the Higaisa group. Retrieved March 2, 2021.

    Open source URL
  59. [59]
    PTSecurity Higaisa 2020

    PT ESC Threat Intelligence. (2020, June 4). COVID-19 and New Year greetings: an investigation into the tools and methods used by the Higaisa group. Retrieved March 2, 2021.

    Open source URL
  60. [60]
    PTSecurity Higaisa 2020

    PT ESC Threat Intelligence. (2020, June 4). COVID-19 and New Year greetings: an investigation into the tools and methods used by the Higaisa group. Retrieved March 2, 2021.

    Open source URL
  61. [61]
    Malwarebytes Higaisa 2020

    Malwarebytes Threat Intelligence Team. (2020, June 4). New LNK attack tied to Higaisa APT discovered. Retrieved March 2, 2021.

    Open source URL
  62. [62]
    Malwarebytes Higaisa 2020

    Malwarebytes Threat Intelligence Team. (2020, June 4). New LNK attack tied to Higaisa APT discovered. Retrieved March 2, 2021.

    Open source URL
  63. [63]
    PTSecurity Higaisa 2020

    PT ESC Threat Intelligence. (2020, June 4). COVID-19 and New Year greetings: an investigation into the tools and methods used by the Higaisa group. Retrieved March 2, 2021.

    Open source URL
  64. [64]
    PTSecurity Higaisa 2020

    PT ESC Threat Intelligence. (2020, June 4). COVID-19 and New Year greetings: an investigation into the tools and methods used by the Higaisa group. Retrieved March 2, 2021.

    Open source URL
  65. [65]
    Zscaler Higaisa 2020

    Singh, S. Singh, A. (2020, June 11). The Return on the Higaisa APT. Retrieved March 2, 2021.

    Open source URL
  66. [66]
    Zscaler Higaisa 2020

    Singh, S. Singh, A. (2020, June 11). The Return on the Higaisa APT. Retrieved March 2, 2021.

    Open source URL
  67. [67]
    Zscaler Higaisa 2020

    Singh, S. Singh, A. (2020, June 11). The Return on the Higaisa APT. Retrieved March 2, 2021.

    Open source URL
  68. [68]
    Zscaler Higaisa 2020

    Singh, S. Singh, A. (2020, June 11). The Return on the Higaisa APT. Retrieved March 2, 2021.

    Open source URL
  69. [69]
    Malwarebytes Higaisa 2020

    Malwarebytes Threat Intelligence Team. (2020, June 4). New LNK attack tied to Higaisa APT discovered. Retrieved March 2, 2021.

    Open source URL
  70. [70]
    Malwarebytes Higaisa 2020

    Malwarebytes Threat Intelligence Team. (2020, June 4). New LNK attack tied to Higaisa APT discovered. Retrieved March 2, 2021.

    Open source URL
  71. [71]
    Zscaler Higaisa 2020

    Singh, S. Singh, A. (2020, June 11). The Return on the Higaisa APT. Retrieved March 2, 2021.

    Open source URL
  72. [72]
    Zscaler Higaisa 2020

    Singh, S. Singh, A. (2020, June 11). The Return on the Higaisa APT. Retrieved March 2, 2021.

    Open source URL
  73. [73]
    PTSecurity Higaisa 2020

    PT ESC Threat Intelligence. (2020, June 4). COVID-19 and New Year greetings: an investigation into the tools and methods used by the Higaisa group. Retrieved March 2, 2021.

    Open source URL
  74. [74]
    PTSecurity Higaisa 2020

    PT ESC Threat Intelligence. (2020, June 4). COVID-19 and New Year greetings: an investigation into the tools and methods used by the Higaisa group. Retrieved March 2, 2021.

    Open source URL
  75. [75]
    PTSecurity Higaisa 2020

    PT ESC Threat Intelligence. (2020, June 4). COVID-19 and New Year greetings: an investigation into the tools and methods used by the Higaisa group. Retrieved March 2, 2021.

    Open source URL
  76. [76]
    PTSecurity Higaisa 2020

    PT ESC Threat Intelligence. (2020, June 4). COVID-19 and New Year greetings: an investigation into the tools and methods used by the Higaisa group. Retrieved March 2, 2021.

    Open source URL
  77. [77]
    Zscaler Higaisa 2020

    Singh, S. Singh, A. (2020, June 11). The Return on the Higaisa APT. Retrieved March 2, 2021.

    Open source URL
  78. [78]
    Zscaler Higaisa 2020

    Singh, S. Singh, A. (2020, June 11). The Return on the Higaisa APT. Retrieved March 2, 2021.

    Open source URL
  79. [79]
    Malwarebytes Higaisa 2020

    Malwarebytes Threat Intelligence Team. (2020, June 4). New LNK attack tied to Higaisa APT discovered. Retrieved March 2, 2021.

    Open source URL
  80. [80]
    Malwarebytes Higaisa 2020

    Malwarebytes Threat Intelligence Team. (2020, June 4). New LNK attack tied to Higaisa APT discovered. Retrieved March 2, 2021.

    Open source URL
  81. [81]
    PTSecurity Higaisa 2020

    PT ESC Threat Intelligence. (2020, June 4). COVID-19 and New Year greetings: an investigation into the tools and methods used by the Higaisa group. Retrieved March 2, 2021.

    Open source URL
  82. [82]
    PTSecurity Higaisa 2020

    PT ESC Threat Intelligence. (2020, June 4). COVID-19 and New Year greetings: an investigation into the tools and methods used by the Higaisa group. Retrieved March 2, 2021.

    Open source URL
  83. [83]
    Malwarebytes Higaisa 2020

    Malwarebytes Threat Intelligence Team. (2020, June 4). New LNK attack tied to Higaisa APT discovered. Retrieved March 2, 2021.

    Open source URL
  84. [84]
    Malwarebytes Higaisa 2020

    Malwarebytes Threat Intelligence Team. (2020, June 4). New LNK attack tied to Higaisa APT discovered. Retrieved March 2, 2021.

    Open source URL
  85. [85]
    Zscaler Higaisa 2020

    Singh, S. Singh, A. (2020, June 11). The Return on the Higaisa APT. Retrieved March 2, 2021.

    Open source URL
  86. [86]
    Zscaler Higaisa 2020

    Singh, S. Singh, A. (2020, June 11). The Return on the Higaisa APT. Retrieved March 2, 2021.

    Open source URL
  87. [87]
    Zscaler Higaisa 2020

    Singh, S. Singh, A. (2020, June 11). The Return on the Higaisa APT. Retrieved March 2, 2021.

    Open source URL
  88. [88]
    Zscaler Higaisa 2020

    Singh, S. Singh, A. (2020, June 11). The Return on the Higaisa APT. Retrieved March 2, 2021.

    Open source URL
  89. [89]
    Malwarebytes Higaisa 2020

    Malwarebytes Threat Intelligence Team. (2020, June 4). New LNK attack tied to Higaisa APT discovered. Retrieved March 2, 2021.

    Open source URL
  90. [90]
    Malwarebytes Higaisa 2020

    Malwarebytes Threat Intelligence Team. (2020, June 4). New LNK attack tied to Higaisa APT discovered. Retrieved March 2, 2021.

    Open source URL
  91. [91]
    Zscaler Higaisa 2020

    Singh, S. Singh, A. (2020, June 11). The Return on the Higaisa APT. Retrieved March 2, 2021.

    Open source URL
  92. [92]
    Zscaler Higaisa 2020

    Singh, S. Singh, A. (2020, June 11). The Return on the Higaisa APT. Retrieved March 2, 2021.

    Open source URL
  93. [93]
    Malwarebytes Higaisa 2020

    Malwarebytes Threat Intelligence Team. (2020, June 4). New LNK attack tied to Higaisa APT discovered. Retrieved March 2, 2021.

    Open source URL
  94. [94]
    Malwarebytes Higaisa 2020

    Malwarebytes Threat Intelligence Team. (2020, June 4). New LNK attack tied to Higaisa APT discovered. Retrieved March 2, 2021.

    Open source URL
  95. [95]
    Zscaler Higaisa 2020

    Singh, S. Singh, A. (2020, June 11). The Return on the Higaisa APT. Retrieved March 2, 2021.

    Open source URL
  96. [96]
    Zscaler Higaisa 2020

    Singh, S. Singh, A. (2020, June 11). The Return on the Higaisa APT. Retrieved March 2, 2021.

    Open source URL
  97. [97]
    Malwarebytes Higaisa 2020

    Malwarebytes Threat Intelligence Team. (2020, June 4). New LNK attack tied to Higaisa APT discovered. Retrieved March 2, 2021.

    Open source URL
  98. [98]
    Malwarebytes Higaisa 2020

    Malwarebytes Threat Intelligence Team. (2020, June 4). New LNK attack tied to Higaisa APT discovered. Retrieved March 2, 2021.

    Open source URL
  99. [99]
    Malwarebytes Higaisa 2020

    Malwarebytes Threat Intelligence Team. (2020, June 4). New LNK attack tied to Higaisa APT discovered. Retrieved March 2, 2021.

    Open source URL
  100. [100]
    PTSecurity Higaisa 2020

    PT ESC Threat Intelligence. (2020, June 4). COVID-19 and New Year greetings: an investigation into the tools and methods used by the Higaisa group. Retrieved March 2, 2021.

    Open source URL
  101. [101]
    Zscaler Higaisa 2020

    Singh, S. Singh, A. (2020, June 11). The Return on the Higaisa APT. Retrieved March 2, 2021.

    Open source URL
  102. [102]
    Malwarebytes Higaisa 2020

    Malwarebytes Threat Intelligence Team. (2020, June 4). New LNK attack tied to Higaisa APT discovered. Retrieved March 2, 2021.

    Open source URL
  103. [103]
    Zscaler Higaisa 2020

    Singh, S. Singh, A. (2020, June 11). The Return on the Higaisa APT. Retrieved March 2, 2021.

    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK siteOfficial STIX data repositoryMITRE ATT&CK terms of use