Apt43

APT43, also known as Kimsuky, is a North Korean Advanced Persistent Threat (APT) group that has been active since at least 2013. The group is known for its intelligence collection activities and using cybercrime to fund espionage. It has been linked to several aliases including Springtail, ARCHIPELAGO, Black Banshee, Thallium, Velvet Chollima, and Emerald Sleet. APT43 has been implicated in a range of cyber-attacks, exploiting vulnerabilities alongside other threat groups such as Black Basta and Bl00dy. The group has even used the leaked LockBit ransomware encryptor in its attacks. The threat posed by APT43, particularly to the U.S. healthcare and public health sector, is significant. The U.S. Department of Health & Human Services' Healthcare Cybersecurity and Communications Integration Center (HHS HC3) has repeatedly expressed concerns about the risks associated with this group, along with other North Korean state-sponsored cybercrime groups like the Lazarus Group. APT43's tactics include social engineering, spear-phishing, credential harvesting, and spoofed personae. They are considered moderately sophisticated in their ability to execute these tactics. Sanctions have been imposed on APT43 by the U.S. Department of the Treasury's Office of Foreign Assets Control (OFAC) due to the group's intelligence gathering activities on behalf of the Democratic People’s Republic of Korea (DPRK). These sanctions were part of a broader effort to counter North Korea's deployment of a military reconnaissance satellite supporting its weapons of mass destruction program. Despite these measures, APT43 continues to evolve, deploying new malware strains such as KLogEXE and FPSpy, and expanding its cyber campaigns to target countries beyond the U.S., including Germany.