Higaisa is a suspected South Korean nation-state threat actor targeting entities connected to North Korea via spearphishing and PlugX.
Analyst brief
Higaisa is a suspected South Korean nation-state threat actor primarily targeting government entities, diplomatic officials, human rights organizations, and individuals connected to North Korea. It gains initial access via spearphishing attachments, uses Visual Basic and Native API for execution, and establishes persistence through Registry Run Keys. The actor deploys malware like PlugX and gh0st RAT for command-and-control over Web Protocols and uses scheduled exfiltration over C2 channels. Defenders should focus on detecting spearphishing campaigns timed around North Korea-related holidays, monitoring for malicious macros, and identifying anomalous C2 traffic and data exfiltration patterns.
Higaisa
nation-state
The organization often uses important North Korean time nodes such as holidays and North Korea to conduct fishing activities. The bait includes New Year blessings, Lantern blessings, North Korean celebrations, and important news, overseas personnel contact lists and so on. In addition, the attack organization also has the attack capability of the mobile terminal. The targets of the attack also include diplomatic entities related to North Korea (such as embassy officials in various places), government officials, human rights organizations, North Korean residents abroad, and traders. The victim countries currently monitored include China, North Korea, Japan, Nepal, Singapore, Russia, Poland, Switzerland, etc.
Monitor network traffic and detect scheduled data transfer and exfiltration over C2 channel.
FAQ2
What method does the Higaisa actor use for initial access?+
Higaisa uses spearphishing attachments for initial access. These emails are often timed around significant dates like North Korea-related holidays and use baits such as New Year blessings or important news.
Which entities does the Higaisa threat actor primarily target?+
Higaisa primarily targets government entities, diplomatic officials (such as embassy officials in various places), human rights organizations, North Korean residents abroad, and traders.