MalwareUsed by 1 actor

GREASE

GREASE is malware used by the North Korea-linked threat actor Kimsuky. It was reported in connection with the STOLEN PENCIL operation in May 2018. Its documented functionality is to add a Windows administrator account or backdoor account on compromised systems and enable Remote Desktop Protocol (RDP) access while avoiding or bypassing firewall rules, providing the actor with continued remote access and persistence. Reporting also describes an updated version of GREASE as creating backdoor accounts for use with RDP connections. The available content directly associates GREASE with Kimsuky’s espionage activity; broader Kimsuky targeting in the cited reporting includes individuals, think tanks, and government-related entities, particularly in South Korea, as well as targets in Japan and the United States. No specific GREASE indicators of compromise are provided in the content.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

Kimsuky

Kimsuky has used a tool called GREASE to add a Windows admin account in order to allow them continued access via RDP.

via mitre attackattack.mitre.org

MITRE ATT&CK

Techniques & procedures

3 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1078.003Local AccountsEvidence1

...used a tool called GREASE to add a Windows admin account in order to allow them continued access via RDP.

Persistence

2 techniques

T1078.003Local AccountsEvidence1

...used a tool called GREASE to add a Windows admin account in order to allow them continued access via RDP.

T1547Boot or Logon Autostart ExecutionEvidence2

“Kimsuky may install a new service that can execute at startup… (Boot or Logon Autostart Execution [T1547]).”

Privilege Escalation

2 techniques

T1078.003Local AccountsEvidence1

...used a tool called GREASE to add a Windows admin account in order to allow them continued access via RDP.

T1547Boot or Logon Autostart ExecutionEvidence2

“Kimsuky may install a new service that can execute at startup… (Boot or Logon Autostart Execution [T1547]).”

Stealth

1 technique

T1078.003Local AccountsEvidence1

...used a tool called GREASE to add a Windows admin account in order to allow them continued access via RDP.

Lateral Movement

1 technique

T1021.001Remote Desktop ProtocolEvidence2

“…GREASE… capable of adding a Windows administrator account and enabling RDP… (Remote Services: Remote Desktop Protocol [T1021.001]).”

INDICATORS OF COMPROMISE

IOCs tracked for this family

24 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

24 tracked

IPs, domains, and DNS infrastructure linked to this family.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in app3 months ago

ACTIVITY FEED

Recent activity

3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

3 SOURCESView more in app

mitre attackNews

Mar 18, 2026

Kimsuky, Black Banshee, Velvet Chollima, Emerald Sleet, THALLIUM, APT43, TA427, Springtail, Group G0094 | MITRE ATT&CK®

Tool used to create/add a Windows administrator account to maintain persistence and enable continued access (notably via RDP).

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching24

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping3

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

GREASE