Kimsuky
Also known as: APT43, Velvet Chollima, Black Banshee, THALLIUM, Emerald Sleet, Springtail
Kimsuky focuses on collecting intelligence about foreign policy and nuclear issues. It leans heavily on social engineering, posing as trusted contacts to build rapport before sending credential-phishing links or malicious documents, and has directed victims to install malicious browser extensions.
- Public attribution
- Publicly attributed by CISA, the FBI and US Cyber Command to North Korea, which they assess tasks the group with a global intelligence-gathering mission.
- Active since
- Around 2012
- Targets
- South Korean government and think tanks
- Experts on Korean Peninsula, nuclear and sanctions policy
- Organisations in the US, Japan and Europe
Notable campaigns
2014Korea Hydro & Nuclear Power
Assessed as responsible for the compromise of South Korea's nuclear operator (MITRE ATT&CK).
2018Operation STOLEN PENCIL
Credential theft against academic targets using a malicious browser extension.
2020US government advisory
CISA, the FBI and US Cyber Command published a joint profile of the group (AA20-301A).
Signature ATT&CK techniques
- T1566.001Phishing: Spearphishing Attachment
- T1598.003Phishing for Information: Spearphishing Link
- T1585.002Establish Accounts: Email Accounts
- T1185Browser Session Hijacking
- T1056.001Input Capture: Keylogging
- T1539Steal Web Session Cookie
Selected from the group's MITRE ATT&CK entry, plus initial-access techniques named in the cited advisories.
Defences that work against this actor
- Verify unexpected interview, conference or review requests through a separate channel before opening attachments.
- Use phishing-resistant MFA so captured passwords and one-time codes cannot be replayed.
- Allowlist browser extensions through policy.
- Report impersonation of trusted contacts to the person or organisation being impersonated.