Loading threat actor…
Kimsuky is a North Korean state-sponsored cyberespionage actor active since at least 2012. Associated tracking names include APT43, APT-C-55, Black Banshee, Emerald Sleet, SharpTongue, Sparkling Pisces, Springtail, TA427, Thallium, and Velvet Chollima. Its targets include government organizations, diplomats, think tanks, academics, civil-society experts, and media organizations, particularly in South Korea, with additional targeting in the United States, Japan, Russia, and Ukraine. Its intelligence collection supports North Korean foreign-policy interests and sanctions-evasion efforts. Kimsuky relies heavily on spear phishing and impersonation, including conference invitations, research-collaboration requests, résumé lures, and fraudulent account-login pages. Reply-baiting campaigns begin with benign messages and deliver malicious material only after recipients respond. Delivery methods include malicious Office and Hangul documents, PDF-disguised Windows shortcuts, malicious QR codes, and counterfeit software installers. Its toolset includes script-based loaders, Python backdoors, FPSpy, and Quasar RAT. Credential-access activity includes phishing and credential dumping with Mimikatz and ProcDump. Operation GitPower targets Ukrainian diplomatic, security, international-policy, and civil-society experts. It abuses Codeberg, GitLab, and GitHub for malware distribution, command delivery, and exfiltration. Infection chains employ VBScript and PowerShell, command obfuscation, in-memory execution, scheduled tasks, system-information collection, and file transfers. Other documented persistence mechanisms include startup scripts, registry autostart modifications, account-group manipulation, and RDP access. Most investigated Ukrainian attack attempts in the 2026 campaign were unsuccessful. Kimsuky-linked ransomware distribution has also delivered Endpoint and Funhouse through malicious Hangul résumé documents, staged scripts, Python backdoors, and Quasar RAT. These chains include UAC bypass and process injection. Encryption-based extortion is documented, but cyberespionage remains the actor's dominant operational focus.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
99 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
71 malware families attributed to this actor across reporting.
66 additional families tracked in Mallory.
22 CVEs this actor has used in observed campaigns. 22 of them exploited in the wild.
Recently Exploited Vulnerabilities by Kimsuky: CVE-2017-11882
“In some systems, initial access was gained through exploiting the RDP vulnerability (BlueKeep, CVE-2019-0708). While an RDP vulnerability scanner was found in the compromised system, there is no evidence of its actual use.”
ZDI identified nearly 1,000 malicious .lnk files abusing ZDI-CAN-25373 (aka ZDI-25-148), a vulnerability that allows attackers to execute hidden malicious commands on a victim’s machine by leveraging crafted shortcut files.
APT28 has used a variety of public exploits, including CVE 2020-0688 ... to gain execution on vulnerable Microsoft Exchange... Dragonfly ... exploited ... CVE-2020-0688 for ... MS Exchange... Kimsuky ... including Microsoft Exchange vulnerability CVE-2020-0688. MuddyWater has exploited the Microsoft Exchange memory corruption vulnerability (CVE-2020-0688). During the SolarWinds Compromise, APT29 exploited CVE-2020-0688 against the Microsoft Exchange Control Panel...
Recently Exploited Vulnerabilities by Kimsuky: CVE-2017-0199
17 more CVEs tied to this actor tracked in Mallory.
3,134 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Cited as an example of QR-code phishing. Sends targeted emails containing malicious QR codes that direct recipients to fake login pages on their phones, enabling credential theft while helping evade email security filters.
The post references a Qihoo360 analysis of an APT-C-55 (Kimsuky) attack campaign using multiple delivery paths. Hashtags associate the report with phishing and LNK files, but the supplied text provides no detailed attack chain.
A North Korean threat actor attributed with a campaign against Ukraine that used AI agents and large language models for spear-phishing content and code generation. Reported output included inconsistent targeting and language, mismatched decoys and meeting links, and defective malware code.
Associated with North Korean state-sponsored spear-phishing targeting Ukrainian government, policy, and academic circles. The campaigns seek intelligence about the Russia-Ukraine war, North Korean military casualties, prisoner handling, and captured North Korean soldiers.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.