Skip to content
skopnix
Section B · Adversaries · Dossier
← Adversaries

File · Higaisa · Nation-state · assessed origin South Korea · misp-galaxy + mitre-attack · refreshed 2026-10-06

Higaisa

state sponsor · Korea (Republic of)MITRE G0126 ↗

Higaisa — ATT&CK roseHI

attack rose · 28 techniques across 7 tactics

What changed

ledger · newest first
  1. —todaynew CVE1 new CVE: CVE-2018-0798

Analyst brief

misp-galaxy + mitre-attack

The organization often uses important North Korean time nodes such as holidays and North Korea to conduct fishing activities. The bait includes New Year blessings, Lantern blessings, North Korean celebrations, and important news, overseas personnel contact lists and so on. In addition, the attack organization also has the attack capability of the mobile terminal.

The targets of the attack also include diplomatic entities related to North Korea (such as embassy officials in various places), government officials, human rights organizations, North Korean residents abroad, and traders. The victim countries currently monitored include China, North Korea, Japan, Nepal, Singapore, Russia, Poland, Switzerland, etc.

Observed targets (as stated by the sources)

8 countries · 1 sectors
ChinaNorth KoreaJapanNepalSingaporeRussiaPolandSwitzerlandAssessed origin: South Korea

assessed origin · South Koreaobserved targets · 8

countries · 8

  • China
  • North Korea
  • Japan
  • Nepal
  • Singapore
  • Russia
  • Poland
  • Switzerland

sectors · 1

  • Government

as stated by MISP galaxy / ransomware.live — not inferred

Kill chain

MITRE ATT&CK Enterprise · tap a technique

28 techniques · 7 of 15 tactics

  1. Initial access

    1 technique

  2. Execution

    7 techniques

  3. Persistence

    1 technique

  4. Stealth

    8 techniques

  5. Discovery

    5 techniques

  6. Command and control

    4 techniques

  7. Exfiltration

    2 techniques

select a technique

Arsenal

2 malware · 1 tools
Malware
Malware · 2ATT&CK
PlugXS0013 ↗
gh0st RATS0032 ↗
Tools
Tools · 1ATT&CK
certutilS0160 ↗

as stated by MITRE ATT&CK · “shared by” counts roster dossiers citing the same S-id

CVEs Higaisa is cited as exploiting

none on KEV
  1. CVE-2018-07982026-10-17
    1. “Higaisa has exploited CVE-2018-0798 for execution.”

      cited as exploiting · source: attack.mitre.org ↗ · 2026-10-17

Each line is what a source says, quoted, with the source linked under it. A citation is a source's claim, not our confirmation: read the source before you act on it.

Take it with you

keyless · no signup

References

5 sources
  1. 1.s.tencent.com/research/report/836.html
  2. 2.blog.malwarebytes.com/threat-analysis/2020/06/higaisa
  3. 3.attack.mitre.org/groups/G0126
  4. 4.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/covid-19-an…
  5. 5.zscaler.com/blogs/security-research/return-higaisa-apt

Track Higaisa on the wire.

This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.

Follow on TelegramKEV RSSAPI

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.