Kimsuky — Threat Actors — SecurityStudies.info

News fetched Nov 13, 00:01 UTC

Cyber threats / Threat actors

Profile

Also known as: APT43, Black Banshee, Earth Kumiho, Emerald Sleet, G0086, Operation Stolen Pencil, PatheticSlug, Sparkling Pisces, Springtail, TA427, THALLIUM, Velvet Chollima

This threat actor targets South Korean think tanks, industry, nuclear power operators, and the Ministry of Unification for espionage purposes.

Related profiles: UNC4736

Profiles whose description names this actor, that this description names, or that share one of its names. The sources mention them together; they are not necessarily the same group.

ATT&CK techniques · 130

Reconnaissance

T1589.002Email Addresses T1589.003Employee Names T1591Gather Victim Org Information T1593.001Social Media T1593.002Search Engines T1594Search Victim-Owned Websites T1596Search Open Technical Databases T1598Phishing for Information T1598.003Spearphishing Link T1682Query Public AI Services

Resource Development

T1583Acquire Infrastructure T1583.001Domains T1583.004Server T1583.006Web Services T1584.001Domains T1585Establish Accounts T1585.001Social Media Accounts T1585.002Email Accounts T1586.002Email Accounts T1587Develop Capabilities T1587.001Malware T1588.002Tool T1588.003Code Signing Certificates T1588.005Exploits T1608.001Upload Malware

Initial Access

T1078.003Local Accounts T1133External Remote Services T1190Exploit Public-Facing Application T1566Phishing T1566.001Spearphishing Attachment T1566.002Spearphishing Link

Execution

T1053.005Scheduled Task T1059.001PowerShell T1059.003Windows Command Shell T1059.005Visual Basic T1059.006Python T1059.007JavaScript T1106Native API T1204.001Malicious Link T1204.002Malicious File T1204.004Malicious Copy and Paste T1559.001Component Object Model

Persistence

T1098.007Additional Local or Domain Groups T1112Modify Registry T1136.001Local Account T1176.001Browser Extensions T1205Traffic Signaling T1505.003Web Shell T1543.003Windows Service T1546.001Change Default File Association T1547.001Registry Run Keys / Startup Folder

Privilege Escalation

T1055Process Injection T1055.001Dynamic-link Library Injection T1055.012Process Hollowing

Defense Impairment

T1553.002Code Signing T1685Disable or Modify Tools T1686Disable or Modify System Firewall

Credential Access

T1003.001LSASS Memory T1040Network Sniffing T1056.001Keylogging T1056.003Web Portal Capture T1111Multi-Factor Authentication Interception T1539Steal Web Session Cookie T1552.001Credentials In Files T1552.004Private Keys T1555.003Credentials from Web Browsers T1557Adversary-in-the-Middle

Discovery

T1007System Service Discovery T1012Query Registry T1016System Network Configuration Discovery T1033System Owner/User Discovery T1057Process Discovery T1082System Information Discovery T1083File and Directory Discovery T1124System Time Discovery T1217Browser Information Discovery T1518.001Security Software Discovery T1680Local Storage Discovery

Lateral Movement

T1021.001Remote Desktop Protocol T1534Internal Spearphishing T1550.002Pass the Hash

Collection

T1005Data from Local System T1074.001Local Data Staging T1113Screen Capture T1114.002Remote Email Collection T1114.003Email Forwarding Rule T1115Clipboard Data T1185Browser Session Hijacking T1560.001Archive via Utility T1560.003Archive via Custom Method

Command and Control

T1071.001Web Protocols T1071.002File Transfer Protocols T1071.003Mail Protocols T1102.001Dead Drop Resolver T1102.002Bidirectional Communication T1105Ingress Tool Transfer T1132.002Non-Standard Encoding T1219.002Remote Desktop Software T1568Dynamic Resolution

Exfiltration

T1020Automated Exfiltration T1041Exfiltration Over C2 Channel T1567.002Exfiltration to Cloud Storage

Impact

T1489Service Stop T1657Financial Theft

Incidents attributed

No incident in the register is attributed to this actor.

In the news · last mention Oct 29

Tracking AI adoption in North Korean threat actor tradecraft
Microsoft Threat Intelligence · Oct 29, 2026

Targets

Elsewhere: Germany

Sectors: Academia - University , Defense, Diplomacy, Energy, Government, News - Media, Private sector, Research - Innovation

Relevance to the EU

EU relevance: Medium

Targets EU member states (Germany)

No EU cooperation projects recorded in its target countries.

References

Sources: MISP, MITRE