Skip to content
skopnix
Section B · Adversaries · Dossier
← Adversaries

File · Kimsuky · Nation-state · assessed origin North Korea · misp-galaxy + mitre-attack · refreshed 2026-10-06

Kimsuky

  • Velvet Chollima
  • Black Banshee
  • Thallium
  • Operation Stolen Pencil
  • G0086
  • APT43
  • Emerald Sleet
  • THALLIUM

state sponsor · Korea (Democratic People's Republic of)MITRE G0094 ↗

Kimsuky — ATT&CK roseKI

attack rose · 130 techniques across 15 tactics

Analyst brief

misp-galaxy + mitre-attack

This threat actor targets South Korean think tanks, industry, nuclear power operators, and the Ministry of Unification for espionage purposes.

Observed targets (as stated by the sources)

1 countries · 8 sectors
GermanyAssessed origin: North Korea

assessed origin · North Koreaobserved targets · 1

countries · 1

  • Germany

sectors · 8

  • Government
  • Private sector
  • Research - Innovation
  • Energy
  • Defense
  • Diplomacy
  • Academia - University
  • News - Media

also stated: Ministry of Unification, Sejong Institute, Korea Institute for Defense Analyses

as stated by MISP galaxy / ransomware.live — not inferred

Kill chain

MITRE ATT&CK Enterprise · tap a technique

130 techniques · 15 of 15 tactics

  1. Reconnaissance

    10 techniques

  2. Resource development

    15 techniques

  3. Initial access

    4 techniques

  4. Execution

    11 techniques

  5. Persistence

    7 techniques

  6. Privilege escalation

    1 technique

  7. Stealth

    31 techniques

  8. Defense impairment

    4 techniques

  9. Credential access

    8 techniques

  10. Discovery

    11 techniques

  11. Lateral movement

    3 techniques

  12. Collection

    11 techniques

  13. Command and control

    9 techniques

  14. Exfiltration

    3 techniques

  15. Impact

    2 techniques

select a technique

Arsenal

13 malware · 6 tools
Malware
Malware · 13ATT&CK
Troll StealerS1196 ↗
HTTPTroyS9007 ↗
AmadeyS1025 ↗
GoBearS1197 ↗
Brave PrinceS0252 ↗
gh0st RATS0032 ↗
AppleSeedS0622 ↗
GomirS1198 ↗
NOKKIS0353 ↗
Gold DragonS0249 ↗
KGH_SPYS0526 ↗
BabySharkS0414 ↗
TRANSLATEXTS1201 ↗
Tools
Tools · 6ATT&CK
schtasksS0111 ↗
certutilS0160 ↗
CSPY DownloaderS0527 ↗
QuasarRATS0262 ↗
PsExecS0029 ↗
MimikatzS0002 ↗

as stated by MITRE ATT&CK · “shared by” counts roster dossiers citing the same S-id

CVEs Kimsuky is cited as exploiting

none on KEV
  1. CVE-2020-06882026-10-17
    1. “Kimsuky has exploited various vulnerabilities for initial access, including Microsoft Exchange vulnerability CVE-2020-0688.”

      cited as exploiting · source: attack.mitre.org ↗ · 2026-10-17

Each line is what a source says, quoted, with the source linked under it. A citation is a source's claim, not our confirmation: read the source before you act on it.

Primary-source reports

via APTnotes · linked, never re-hosted
  1. 2023Kimsuky Group Uses AutoIt to Create Malware (RftRAT, Amadey)Ahnlab ↗
  2. 2022Kimsuky Group's APT Attacks (AppleSeed, PebbleDash)Ahnlab ↗
  3. 2021Kimsuky Espionage CampaignInquest ↗
  4. 2013The "Kimsuky" Operation: A North Korean Apt?Kaspersky ↗

Take it with you

keyless · no signup

References

25 sources
  1. 1.securelist.com/the-kimsuky-operation-a-north-korean-apt/57915
  2. 2.cfr.org/interactive/cyber-operations/kimsuky
  3. 3.pwc.co.uk/issues/cyber-security-data-privacy/research/tracking-k…
  4. 4.youtu.be/hAsKp43AZmM?t=1027
  5. 5.bloomberglaw.com/document/public/subdoc/X67FPNDOUBV9VOPS35A4864BFIU?ima…
  6. 6.netscout.com/blog/asert/stolen-pencil-campaign-targets-academia
  7. 7.unit42.paloaltonetworks.com/new-babyshark-malware-targets-u-s-national-security-th…
  8. 8.attack.mitre.org/groups/G0086
  9. 9.us-cert.cisa.gov/ncas/alerts/aa20-301a
  10. 10.cybereason.com/blog/back-to-the-future-inside-the-kimsuky-kgh-spyware…
  11. +15 more in the JSON record

Track Kimsuky on the wire.

This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.

Follow on TelegramKEV RSSAPI

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.