Kimsuky

Threat Actor updated 3 days ago (2024-09-04T20:17:49.696Z)

Download STIX

Preview STIX

Kimsuky, also known as Springtail, ARCHIPELAGO, Black Banshee, Thallium, Velvet Chollima, and APT43, is a North Korea-linked threat actor first identified by a Kaspersky researcher in 2013. This cyberespionage group has been associated with various malicious activities, including spear-phishing campaigns and attacks through Messenger. The group is particularly adept at using social engineering to steal cryptocurrency, with these threat campaigns aimed at gathering funds to support North Korea's nuclear program and other initiatives of Supreme Leader Kim Jong Un. In recent developments, Kimsuky has been linked to the deployment of a new remote access trojan (RAT) called MoonPeak. This connection was established by Cisco Talos, which also uncovered the infrastructure used by another North Korea-linked advanced persistent threat (APT) group known as UAT-5394. While there isn't enough technical evidence to definitively link UAT-5394 to Kimsuky, both groups share similar tactics, techniques, and procedures (TTPs), suggesting either a subgroup within Kimsuky or a separate North Korean group mimicking Kimsuky's TTPs and infrastructure patterns. Furthermore, Kimsuky has recently been observed exploiting weak DMARC policies and using a custom tool called "SendMail" to send phishing emails using compromised email accounts. The group has also incorporated a new Linux backdoor into its recent attacks, demonstrating its ongoing evolution and adaptation to new technologies and techniques. Given these activities, Kimsuky continues to pose a significant threat in the cybersecurity landscape, requiring continued vigilance and robust security measures.

Description last updated: 2024-09-04T20:15:32.649Z

What's your take? (Question 1 of 5)

Help tune the shared Cybergeist dataset, assist your peers, and earn karma. Expand the panel to get started.

Possible Aliases / Cluster overlaps

It's hard to track cluster overlaps and naming conventions between vendors, so here are some possible overlapping names / profiles you also may want to look at.

ID	Votes	Profile Description
Thallium	6	Thallium, also known as Kimsuky, Velvet Chollima, and APT43, is a North Korean state-sponsored threat actor or hacking group that has been active since 2012. Tracked by the Cybereason Nocturnus Team and other security researchers, this cyber espionage group is believed to operate on behalf of the No
Velvet Chollima	6	Velvet Chollima, also known as Kimsuky, APT43, Thallium, Black Banshee, and Emerald Sleet among other names, is a threat actor believed to be based in North Korea. The group has been active since 2012 and is linked to North Korea’s General Reconnaissance Bureau, the country's main military intellige
APT37	4	APT37, also known as ScarCruft, Reaper, or Group123, is a threat actor suspected to be linked to North Korea. It primarily targets South Korea but has also extended its activities to Japan, Vietnam, and the Middle East, focusing on various industry verticals such as chemicals, electronics, manufactu
Lazarus Group	3	The Lazarus Group, a notorious threat actor associated with North Korea, has been implicated in several high-profile cyber attacks and exploitation activities. The group's objective often involves establishing a kernel read/write primitive, which allows them to gain high-level access to systems and
KONNI	3	Konni is a malware, short for malicious software, that poses a significant threat to computer systems and data. It's designed to infiltrate systems surreptitiously through suspicious downloads, emails, or websites, often unbeknownst to the user. Once inside a system, Konni can wreak havoc by stealin
Apt43	3	APT43, also known as Kimsuky, is a North Korean state-sponsored advanced persistent threat (APT) group that has been actively involved in cybercrime and espionage. The group has been implicated in a series of attacks exploiting vulnerabilities, which have drawn the attention of various cybersecurity
STOLEN PENCIL	2	The STOLEN PENCIL operation, first reported in May 2018, was a cyber espionage campaign potentially originating from the Democratic People's Republic of Korea (DPRK). The threat actor, known as Kimsuky, targeted academic institutions using spear-phishing tactics for initial intrusion. This involved
Black Banshee	2	Black Banshee, also known as Kimsuky, APT43, Emerald Sleet, Velvet Chollima, and TA406, is a threat actor group believed to be operating under the North Korean Reconnaissance General Bureau (RGB), the country's primary intelligence service. The group has been active since at least 2012, according to
Reconnaissance General Bureau	2	The Reconnaissance General Bureau (RGB) is a North Korean intelligence agency responsible for clandestine operations abroad, and it is believed to coordinate the nation's cyber activities. The RGB has been linked to several advanced persistent threat (APT) groups, including BeagleBoyz, Kimsuky, Anda

Miscellaneous Associations

Other elements of context that could aid in the identification of relevance

Malware

Apt

Korean

Phishing

Exploit

Reconnaissance

Police

Backdoor

State Sponso...

Cybercrime

Linux

Chrome

Ransomware

Espionage

Spearphishing

Windows

Sentinelone

Spyware

Payload

Microsoft

Android

Trojan

Tool

Dprk

Rat

Screenconnect

Vulnerability

Exploits

Analyst Notes & Discussion

Be the first to leave your mark here! Log in to share your views and vote.

Associated Malware

To see the evidence that has resulted in these malware associations, create a free account

ID	Type	Votes	Profile Description
BabyShark	Unspecified	5	BabyShark is a malicious software (malware) that has been linked to the North Korean Advanced Persistent Threat (APT) group known as Kimsuky, also referred to as Thallium and Velvet Chollima. This malware, written in Microsoft Visual Basic script, was first identified in November 2018 and was used p
Reconshark	Unspecified	5	ReconShark is a new malware variant deployed by the North Korea-linked Advanced Persistent Threat (APT) group, Kimsuky. This tool has been observed in an ongoing campaign, used as an infostealer-downloader and is a new iteration of the group's custom BabyShark malware family. The ReconShark tool is
Black Basta	Unspecified	2	Black Basta is a notorious malware group known for its ransomware activities. The group has been active since at least early 2022, during which time it has accumulated an estimated $107 million in Bitcoin ransom payments. It leverages malicious software to infiltrate and exploit computer systems, of
Toddleshark	Unspecified	2	ToddleShark is a new variant of malware, believed to be an evolution of Kimsuky's BabyShark and ReconShark backdoors. It has been identified by Kroll's analysts as being used by the North Korean APT hacking group Kimsuky to target government organizations, research centers, universities, and think t

Associated Threat Actors

To see the evidence that has resulted in these threatActor associations, create a free account

ID	Type	Votes	Profile Description
Andariel	Unspecified	5	Andariel, a state-backed threat group linked to North Korea's Reconnaissance General Bureau, has been identified as a significant cyber threat. The group has demonstrated its capabilities by compromising critical national infrastructure organizations, accessing classified technical information and i
Rgb	Unspecified	2	RGB is a threat actor group associated with North Korea's Reconnaissance General Bureau (RGB), which has been involved in numerous cyber espionage activities. The RGB 3rd Bureau, based in Pyongyang and Sinuiju, includes state-sponsored cyber groups known as Andariel, Onyx Sleet (formerly PLUTONIUM),
ScarCruft	Unspecified	2	ScarCruft, also known as APT37, Inky Squid, RedEyes, Reaper, or Group123, is a North Korean threat actor group associated with malicious cyber activities. Their actions have been linked to the execution of targeted attacks against individual Android devices, as outlined in a VB2023 paper titled "Int

Source Document References

Information about the Kimsuky Threat Actor was read from the documents corpus below. This display is limited to 20 results, create a free account to see more

Source Link	CreatedAt	Title
DARKReading	3 days ago	FBI: North Korean Actors Readying Aggressive Cyberattack Wave
Securityaffairs	17 days ago	North Korea-linked APT used a new RAT called MoonPeak
InfoSecurity-magazine	17 days ago	New MoonPeak RAT Linked to North Korean Threat Group UAT-5394
Securityaffairs	a month ago	SECURITY AFFAIRS MALWARE NEWSLETTER – ROUND 6
InfoSecurity-magazine	a month ago	North Korea Kimsuky Launch Phishing Attacks on Universities
Securityaffairs	a month ago	North Korea-linked hackers target construction and machinery sectors with watering hole and supply chain attacks
Securityaffairs	a month ago	security-affairs-malware-newsletter-round-5
Securityaffairs	2 months ago	Security Affairs Malware Newsletter - Round 3
Securityaffairs	2 months ago	Security Affairs Malware Newsletter - Round 3
Securityaffairs	2 months ago	Security Affairs Malware Newsletter - Round 2
BankInfoSecurity	2 months ago	Breach Roundup: Microsoft Patches Zero-Day Active Since 2023
Securityaffairs	2 months ago	Security Affairs Malware Newsletter - Round 1
Securityaffairs	2 months ago	Security Affairs newsletter Round 478 by Pierluigi Paganini – INTERNATIONAL EDITION
Securityaffairs	3 months ago	Security Affairs newsletter Round 477 by Pierluigi Paganini – INTERNATIONAL EDITION
Securityaffairs	3 months ago	Security Affairs newsletter Round 476 by Pierluigi Paganini – INTERNATIONAL EDITION
Securityaffairs	3 months ago	Security Affairs newsletter Round 473 by Pierluigi Paganini – INTERNATIONAL EDITION
Securityaffairs	4 months ago	North Korean Kimsuky used a new Linux backdoor in recent attacks
Securityaffairs	4 months ago	Security Affairs newsletter Round 472 by Pierluigi Paganini – INTERNATIONAL EDITION
Securityaffairs	4 months ago	North Korea-linked Kimsuky APT attack targets victims via Messenger
BankInfoSecurity	4 months ago	Breach Roundup: Kimsuky Serves Linux Trojan