Kimsuky
Threat actorAttributed to South Korea by MITRE ATT&CK (source). An attribution, not a proven fact.
Names and who uses them
- KimsukyOur name
- APT43Mandiant
- Emerald SleetMicrosoft
- Black BansheeMITRE ATT&CK
- Earth KumihoMITRE ATT&CK
- PatheticSlugMITRE ATT&CK
- THALLIUMMITRE ATT&CK
- Velvet ChollimaMITRE ATT&CK
- TA427Proofpoint
- SpringtailSymantec
Targets
Sectors: Government, NGOs and think tanks
Regions: South Korea
Source: MITRE ATT&CKKnown techniques
- T1003.001LSASS Memory
- T1005Data from Local System
- T1007System Service Discovery
- T1012Query Registry
- T1016System Network Configuration Discovery
- T1020Automated Exfiltration
- T1021.001Remote Desktop Protocol
- T1027Obfuscated Files or Information
- T1027.001Binary Padding
- T1027.002Software Packing
- T1027.007Dynamic API Resolution
- T1027.010Command Obfuscation
- T1027.012LNK Icon Smuggling
- T1027.013Encrypted/Encoded File
- T1027.015Compression
- T1027.016Junk Code Insertion
- T1033System Owner/User Discovery
- T1036.004Masquerade Task or Service
- T1036.005Match Legitimate Resource Name or Location
- T1036.007Double File Extension
- T1040Network Sniffing
- T1041Exfiltration Over C2 Channel
- T1053.005Scheduled Task
- T1055Process Injection
- T1055.001Dynamic-link Library Injection
- T1055.012Process Hollowing
- T1056.001Keylogging
- T1056.003Web Portal Capture
- T1057Process Discovery
- T1059.001PowerShell
- T1059.003Windows Command Shell
- T1059.005Visual Basic
- T1059.006Python
- T1059.007JavaScript
- T1070.004File Deletion
- T1070.006Timestomp
- T1071.001Web Protocols
- T1071.002File Transfer Protocols
- T1071.003Mail Protocols
- T1074.001Local Data Staging
Malware and tools used
AmadeyAppleSeedBabySharkBrave PrincecertutilCSPY Downloadergh0st RATGoBearGold DragonGomirHTTPTroyKGH_SPYMimikatzNOKKIPsExecQuasarRATschtasksTRANSLATEXTTroll Stealer
Source: MITRE ATT&CKRecent news
No stories yet.