Threat actorLinked to in-the-wild CVEs

Kimsuki

Updated 21 days ago

Trending this weekNot trendingOutside this week’s top 100

Mention activity · 30 daysNo mention activity in the last 30 days.

CVEs1Associated

Malware0Families

ATT&CK0Techniques

IOCs0Tracked

Origin: 🇰🇵 North Korea
Motivation: —

Also known asKimsuki

Are they targeting you?See whether this actor's campaigns touch your sector, your geography, or the products you run, and get alerted when that changes.

Check your exposure

Operational profile

Targeting

Who, where, and from where this actor operates. Pulled from open-source reporting and Mallory's analyst review.

Where they're from

Attributed origin per open-source reporting.

North Korea

Vulnerabilities

Associated vulnerabilities

1 CVE Mallory has associated with this actor across public reporting. 1 of them is exploited in the wild (not necessarily by this actor).

CVE-2024-271981 evidence · Oct 9, 2026Exploited in the wildAuthentication bypass and remote code execution in JetBrains TeamCityCVE-2024-27198 is a critical authentication bypass vulnerability identified within the web component of JetBrains TeamCity versions before 2023.11.4. This vulnerability enables remote unauthenticated attackers to circumvent authentication checks by crafting specific URLs.View vulnerability →

Activity feed

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

View more in app →

cyfirma blogNews · Apr 3, 2024Vulnerability Analysis and Exploitation : Understanding CVE-2024-27198 in JetBrains TeamCity - CYFIRMAReportedly actively targeting the TeamCity authentication-bypass vulnerability CVE-2024-27198. The report does not provide actor-specific evidence of successful compromise or identify payloads deployed by this group.Read more ↗

Are they targeting you?See whether this actor's campaigns touch your sector, your geography, or the products you run, and get alerted when that changes.

Check your exposure

Mallory platform

The version that knows your environment.

This page is what's public. Mallory adds the parts that aren't: whether this actor's tooling has touched your footprint, the IOCs they're burning right now, and the detections to deploy next.

Start Free Trial Open in App ↗

Target overlapMatch sector + geo + tech-stack targeting against your real footprint.

Tradecraft mappingMITRE ATT&CK techniques reported for this actor, grouped by tactic.

Associated malwareFamilies linked to this actor, with IOCs and behavior.

Associated CVEs1CVEs linked to this actor, with the reporting behind each link.

Detection signaturesYARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

ObservablesDomains, IPs, and hashes tied to this actor, refreshed continuously.

Kimsuki

Updated 21 days ago

Trending this weekNot trendingOutside this week’s top 100

Mention activity · 30 daysNo mention activity in the last 30 days.

CVEs1Associated

Malware0Families

ATT&CK0Techniques

IOCs0Tracked

Origin: 🇰🇵 North Korea
Motivation: —

Also known asKimsuki

Are they targeting you?See whether this actor's campaigns touch your sector, your geography, or the products you run, and get alerted when that changes.

Check your exposure