type: intrusion-set
spec_version: 2.1
id: intrusion-set--0ec2f388-bf0f-4b5c-97b1-fc736d26c25f
created: 2019-08-26T15:03:02.577Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/groups/G0094
external_id: G0094
source_name: Black Banshee
description: (Citation: Cybereason Kimsuky November 2020)(Citation: Malwarebytes Kimsuky June 2021)
source_name: THALLIUM
description: (Citation: Cybereason Kimsuky November 2020)(Citation: Malwarebytes Kimsuky June 2021)(Citation: Mandiant APT43 March 2024)(Citation: Proofpoint TA427 April 2024)
source_name: APT43
description: (Citation: Mandiant APT43 March 2024)(Citation: Proofpoint TA427 April 2024)
source_name: Emerald Sleet
description: (Citation: Microsoft Threat Actor Naming July 2023)(Citation: Proofpoint TA427 April 2024)
source_name: TA427
description: (Citation: Proofpoint TA427 April 2024)
source_name: Kimsuky
description: (Citation: Securelist Kimsuky Sept 2013)(Citation: Malwarebytes Kimsuky June 2021)
source_name: Springtail
description: (Citation: Symantec Troll Stealer 2024)
source_name: Velvet Chollima
description: (Citation: Zdnet Kimsuky Dec 2018)(Citation: ThreatConnect Kimsuky September 2020)(Citation: Malwarebytes Kimsuky June 2021)
source_name: AhnLab Kimsuky Kabar Cobra Feb 2019
description: AhnLab. (2019, February 28). Operation Kabar Cobra - Tenacious cyber-espionage campaign by Kimsuky Group. Retrieved September 29, 2021.
url: https://global.ahnlab.com/global/upload/download/techreport/%5BAnalysis_Report%5DOperation%20Kabar%20Cobra.pdf
source_name: EST Kimsuky April 2019
description: Alyac. (2019, April 3). Kimsuky Organization Steals Operation Stealth Power. Retrieved August 13, 2019.
url: https://blog.alyac.co.kr/2234
source_name: Netscout Stolen Pencil Dec 2018
description: ASERT team. (2018, December 5). STOLEN PENCIL Campaign Targets Academia. Retrieved February 5, 2019.
url: https://asert.arbornetworks.com/stolen-pencil-campaign-targets-academia/
source_name: Zdnet Kimsuky Dec 2018
description: Cimpanu, C.. (2018, December 5). Cyber-espionage group uses Chrome extension to infect victims. Retrieved August 26, 2019.
url: https://www.zdnet.com/article/cyber-espionage-group-uses-chrome-extension-to-infect-victims/
source_name: CISA AA20-301A Kimsuky
description: CISA, FBI, CNMF. (2020, October 27). https://us-cert.cisa.gov/ncas/alerts/aa20-301a. Retrieved November 4, 2020.
url: https://us-cert.cisa.gov/ncas/alerts/aa20-301a
source_name: Cybereason Kimsuky November 2020
description: Dahan, A. et al. (2020, November 2). Back to the Future: Inside the Kimsuky KGH Spyware Suite. Retrieved November 6, 2020.
url: https://www.cybereason.com/blog/back-to-the-future-inside-the-kimsuky-kgh-spyware-suite
source_name: EST Kimsuky SmokeScreen April 2019
description: ESTSecurity. (2019, April 17). Analysis of the APT Campaign ‘Smoke Screen’ targeting to Korea and US 출처: https://blog.alyac.co.kr/2243 [이스트시큐리티 알약 블로그]. Retrieved September 29, 2021.
url: https://blog.alyac.co.kr/attachment/cfile5.uf@99A0CD415CB67E210DCEB3.pdf
source_name: Malwarebytes Kimsuky June 2021
description: Jazi, H. (2021, June 1). Kimsuky APT continues to target South Korean government using AppleSeed backdoor. Retrieved June 10, 2021.
url: https://blog.malwarebytes.com/threat-analysis/2021/06/kimsuky-apt-continues-to-target-south-korean-government-using-appleseed-backdoor/
source_name: Proofpoint TA427 April 2024
description: Lesnewich, G. et al. (2024, April 16). From Social Engineering to DMARC Abuse: TA427’s Art of Information Gathering. Retrieved May 3, 2024.
url: https://www.proofpoint.com/us/blog/threat-insight/social-engineering-dmarc-abuse-ta427s-art-information-gathering
source_name: Mandiant APT43 March 2024
description: Mandiant. (2024, March 14). APT43: North Korean Group Uses Cybercrime to Fund Espionage Operations. Retrieved May 3, 2024.
url: https://services.google.com/fh/files/misc/apt43-report-en.pdf
source_name: Microsoft Threat Actor Naming July 2023
description: Microsoft . (2023, July 12). How Microsoft names threat actors. Retrieved November 17, 2023.
url: https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide
source_name: MSFT-AI
description: Microsoft Threat Intelligence. (2024, February 14). Staying ahead of threat actors in the age of AI. Retrieved March 11, 2024.
url: https://www.microsoft.com/en-us/security/blog/2024/02/14/staying-ahead-of-threat-actors-in-the-age-of-ai/
source_name: Symantec Troll Stealer 2024
description: Symantec Threat Hunter Team. (2024, May 16). Springtail: New Linux Backdoor Added to Toolkit. Retrieved January 17, 2025.
url: https://www.security.com/threat-intelligence/springtail-kimsuky-backdoor-espionage
source_name: Securelist Kimsuky Sept 2013
description: Tarakanov , D.. (2013, September 11). The “Kimsuky” Operation: A North Korean APT?. Retrieved August 13, 2019.
url: https://securelist.com/the-kimsuky-operation-a-north-korean-apt/57915/
source_name: ThreatConnect Kimsuky September 2020
description: ThreatConnect. (2020, September 28). Kimsuky Phishing Operations Putting In Work. Retrieved October 30, 2020.
url: https://threatconnect.com/blog/kimsuky-phishing-operations-putting-in-work/
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-11-12T18:55:12.319Z
name: Kimsuky
description: [Kimsuky](https://attack.mitre.org/groups/G0094) is a North Korea-based cyber espionage group that has been active since at least 2012. The group initially targeted South Korean government agencies, think tanks, and subject-matter experts in various fields. Its operations expanded to include the United Nations and organizations in the government, education, business services, and manufacturing sectors across the United States, Japan, Russia, and Europe. [Kimsuky](https://attack.mitre.org/groups/G0094) has focused collection on foreign policy and national security issues tied to the Korean Peninsula, nuclear policy, and sanctions. Its operations have overlapped with other DPRK actors, likely due to ad hoc collaboration or limited resource sharing.(Citation: EST Kimsuky April 2019)(Citation: Cybereason Kimsuky November 2020)(Citation: Malwarebytes Kimsuky June 2021)(Citation: CISA AA20-301A Kimsuky)(Citation: Mandiant APT43 March 2024)(Citation: Proofpoint TA427 April 2024) Because of overlapping operations, some researchers group a wide range of North Korean state-sponsored cyber activity under the broader [Lazarus Group](https://attack.mitre.org/groups/G0032) umbrella rather than tracking separate subgroup or cluster distinctions.

[Kimsuky](https://attack.mitre.org/groups/G0094) was assessed to be responsible for the 2014 Korea Hydro & Nuclear Power Co. compromise; other notable campaigns include Operation STOLEN PENCIL (2018), Operation Kabar Cobra (2019), and Operation Smoke Screen (2019).(Citation: Netscout Stolen Pencil Dec 2018)(Citation: EST Kimsuky SmokeScreen April 2019)(Citation: AhnLab Kimsuky Kabar Cobra Feb 2019)

In 2023, [Kimsuky](https://attack.mitre.org/groups/G0094) was observed using commercial large language models to assist with vulnerability research, scripting, social engineering and reconnaissance.(Citation: MSFT-AI)
aliases: Kimsuky
Black Banshee
Velvet Chollima
Emerald Sleet
THALLIUM
APT43
TA427
Springtail
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_version: 5.1
x_mitre_attack_spec_version: 3.3.0
x_mitre_contributors: Taewoo Lee, KISA
Dongwook Kim, KISA
Jaesang Oh, KC7 Foundation
Wai Linn Oo @ Kernellix
x_mitre_domains: enterprise-attack