Also known as: Velvet Chollima, THALLIUM, Emerald Sleet, Black Banshee, APT43, Archipelago, SharpTongue, TA406, Springtail, TA427, Sparkling Pisces, Kimsuki, Baby Coin, Konni, APT-Q-37, Jade Sleet, Nickel Kimball, Ruby Sleet, Opal Sleet, Crooked Pisces, Cerium, Osmium
Spearphishing Attachment
Send targeted emails with malicious file attachments to gain initial access.
Spearphishing Link
Send targeted emails with malicious links to credential harvesting or exploit pages.
Valid Accounts
Use legitimate credentials to authenticate and gain access.
Drive-by Compromise
Gain access through a user visiting a compromised website during normal browsing.
Phishing
Send deceptive messages to trick victims into executing malicious content.
Exploit Public-Facing Application
Exploit vulnerabilities in internet-facing applications to gain access.
T1598.003
T1204.001
T1204.002
T1059.005
T1059.006
T1071.001
T1102
T1056.001
T1114.002
T1539
T1583.001
T1598
T1056.003
T1562.004
T1550.002
T1588.006
T1534
T1185
T1567.002
T1608.001
T1608.004
T1608.005
T1589.002
T1591
T1593
T1594
T1213
T1583.006
T1586.002
T1586.003
T1585.002
T1583.003
T1218.011
T1036.005
T1036.001
T1218.005
T1553.002
T1055.001
T1057
T1614.001
T1033
T1518.001
T1070.004
T1119
T1560.001
T1020
T1048.003
T1071.004
T1132.001
T1566.003
T1221
T1176
T1137
T1016
T1049
T1069
T1124
T1497
T1552.001
T1552.004
T1573.001
T1571
T1053.005
T1569.001
T1129
T1574.001
T1543.003
T1547.009
T1114.001
T1087.002
T1087.003
T1003.005
T1555.003
T1114.003
T1213.002
T1588.002
T1588.001
T1583.004
T1584.004
T1027.002
T1027.010
T1203
T1566.004
VBScript-based reconnaissance tool that exfiltrates system information via HTTP. Used as initial access payload in spear-phishing campaigns targeting think tanks and policy researchers.
Full-featured backdoor supporting keylogging, screenshot capture, file exfiltration, and additional module loading. Primary persistent access tool in Kimsuky campaigns.
Reconnaissance tool delivered via weaponized documents. Exfiltrates system configuration, running processes, and battery info to determine if target is worth further exploitation.
Malicious Chromium browser extension that reads email directly from the victim's webmail (Gmail, AOL, Yahoo). Bypasses 2FA since it operates within the authenticated browser session.
Multi-component backdoor that uses a dedicated module for stealing credentials. Operates with a dropper, injector, and payload architecture for modular deployment.
PowerShell-based reconnaissance and data collection tool. Gathers system info, installed programs, recent documents, and sends data to attacker-controlled cloud services.
VBScript info-stealer that collects file listings from specific directories. Targets document files to identify intelligence value before deploying heavier payloads.
Android spyware disguised as a security plugin. Captures SMS, call logs, GPS location, and can exfiltrate files from the device. Targets South Korean mobile users.
Abused as C2 channel — malware uploads stolen data to attacker-controlled Google Drive accounts and retrieves commands from shared documents.
Used as file exfiltration channel, with stolen documents and credentials uploaded to attacker-controlled OneDrive accounts to blend with normal cloud traffic.
Used for command-and-control communication, storing encoded commands and receiving exfiltrated data through the Dropbox API.
Used extensively for executing encoded reconnaissance scripts, downloading secondary payloads, and credential harvesting from browser stores.
HTML Application host abused to execute HTA files containing VBScript or JScript payloads, bypassing application whitelisting controls.
Abused for persistent remote access after initial compromise. Legitimate Google tool that's difficult for defenders to distinguish from authorized usage.
Open-source .NET RAT used as a lightweight remote access tool in some Kimsuky campaigns, providing screen control, file management, and keylogging.
Remote access trojan with keylogging and screen capture capabilities
Information stealer targeting browser credentials and email data
Legitimate Metasploit Framework payload used by Kimsuky for post-exploitation
Second-stage malware with command execution capabilities
Malware designed to steal clipboard data including cryptocurrency wallet addresses
PowerShell-based backdoor with command execution and file manipulation capabilities
Credential harvesting tool targeting webmail and social media accounts
Python-based backdoor with keylogging and screenshot capabilities
Remote access trojan with keylogging and screen capture functionality
Windows backdoor delivered through spear-phishing campaigns
Malicious downloader distributed via malicious CHM files
Cloud-based RAT using legitimate cloud services for C2
Variant of AppleSeed backdoor with enhanced capabilities
Commodity botnet malware adopted by Kimsuky for credential theft
Credential and browser data stealer
Generic information stealer targeting browser credentials and system information
Legitimate proxy tool abused for network tunneling
Remote access trojan used for surveillance and data collection operations, capable of keylogging and screenshot capture.
Custom backdoor used in targeted campaigns against defense and government sectors with advanced evasion techniques.
Open-source remote access trojan adopted by Kimsuky for remote control operations
Multi-stage backdoor capable of keylogging, screenshot capture, and file exfiltration. Often deployed alongside AppleSeed.
Email exfiltration tool designed to steal credentials and email content from victims' accounts.
Malware capable of keylogging, screenshot capture, and arbitrary file upload/download functionality.
Information stealer focused on browser credentials and system information
Cloud-based backdoor using cloud storage services for C2
Android mobile malware targeting Korean users, capable of exfiltrating contacts, SMS messages, call logs, and device location.
PowerShell-based information stealer designed to harvest credentials from web browsers and email clients.
PowerShell-based backdoor for remote access and command execution
Tool designed to enumerate and extract email addresses from compromised systems
Malicious payload loader that establishes persistence and deploys subsequent stage malware
Suite of legitimate system administration tools abused for credential harvesting including WebBrowserPassView and Mail PassView
Multi-stage backdoor capable of file operations, command execution, and keylogging
Multi-stage malware loader that deploys additional payloads and maintains persistence on compromised systems
Legitimate CHM file format weaponized to deliver malicious payloads through help documentation
Backdoor malware targeting Windows systems with screen capture and file exfiltration capabilities
Information stealer focused on browser credentials and email harvesting
Multi-stage loader that decodes and executes embedded shellcode to deploy subsequent payloads while evading detection
Dropper used to deploy additional malware components and establish initial access
Chrome browser credential stealer targeting saved passwords and cookies
Information stealer targeting credentials and browser data
Publicly available RAT adopted and modified by Kimsuky for remote control operations
Browser data and credential theft tool
Remote access trojan with keylogging and screen capture capabilities
Legitimate password recovery tool weaponized for email credential theft
Legitimate browser password recovery tool used for credential harvesting
Information stealer targeting credentials and documents
Remote access trojan with keylogging and screen capture capabilities, often used in targeted attacks against South Korean entities.
Banking trojan and information stealer adapted by Kimsuky for credential harvesting operations.
Chrome-based credential stealer and cookie harvester
Loader component that deploys additional payloads and establishes C2 communications
Malware component used for command and control communications and payload delivery
Credential dumping tool used to extract passwords and authentication tokens from memory
Browser extension framework abused to inject malicious scripts for credential harvesting from webmail services
Multi-stage malware framework using cloud services for C2 communications
Variant of AppleSeed with enhanced capabilities and improved obfuscation
PHP-based web shell and proxy tool for network pivoting
Tool used to extract stored credentials from Chrome browser
Legitimate credential harvesting tools including WebBrowserPassView and Mail PassView
Information stealer targeting browser credentials and email data
Custom keylogger written in Visual Basic that captures keystrokes and exfiltrates data to attacker-controlled email accounts or cloud storage services.
VBScript-based backdoor used for reconnaissance and data exfiltration with cloud service abuse
Custom credential harvesting tool targeting Google Chrome stored passwords and authentication data
Legitimate password recovery tool abused for extracting email client credentials
Modified version of open-source credential stealer targeting Chromium-based browsers
Tool designed to exfiltrate email data from compromised accounts and mail servers
Credential harvesting tool targeting browser passwords, email credentials, and system information.
Backdoor that communicates with cloud services for C2 and supports file operations and command execution.
Downloader that fetches secondary payloads and establishes persistence on compromised systems.
Multi-component backdoor framework for sustained espionage operations
PowerShell post-exploitation framework used for privilege escalation and credential dumping
Dropper specifically designed to deploy the AppleSeed backdoor through various infection vectors
Commercial malware loader utilized by Kimsuky to deploy additional malicious components
PowerShell-based backdoor that uses steganography to hide malicious code in images
| Type | Value |
|---|---|
| domain | bigfile[.]pe[.]hu |
| domain | mybobo[.]mygamesonline[.]org |
| ip | 27[.]102[.]114[.]89 |
| ip | 158[.]247[.]222[.]165 |
| hash | 7d0e57a3c12a8e7c0f16e52b3a6e0d5e |
| ip | 27[.]102[.]137[.]181 |
| ip | 158[.]247[.]215[.]121 |
| ip | 158[.]247[.]204[.]137 |
| ip | 158[.]247[.]192[.]226 |
| ip | 158[.]247[.]242[.]206 |
| domain | kzloly[.]nmailhub[.]com |
| hash | 10c3b3ab2e9cb618fc938028c9295ad5bdb1d836b8f07d65c0d3036dbc18bbb4 |
| hash | 509fb00b9d6eaa74f54a3d1f092a161a095e5132d80cc9cc95c184d4e258525b |
| domain | naver[.]kro[.]kr |
| domain | daum[.]kro[.]kr |
| domain | myaccount-help[.]com |
| domain | appleid-unlock[.]com |
| hash | 4c3499f3cc4a4fdc7e67c5e45eb1e93b4e5e5e2e1e0e3c1e9b9c8f7e6d5c4b3a |
| domain | auth-sso[.]com |
| ip | 185[.]244[.]39[.]224 |
| domain | myaccounts-naver[.]com |
| domain | myaccount-google[.]com |
| domain | naver-account[.]com |
| hash | 7d7e3e1a5b6c9c4e2f3a1b5d8c9e4f2a3b7c8d9e1f2a3b4c5d6e7f8a9b0c1d2 |
| domain | read-naver-notice[.]com |
| domain | naver[.]hxtvvl[.]com |
| domain | daum[.]hxtvvl[.]com |
| domain | dhlone[.]com |
| hash | a9b8c7d6e5f4a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6 |
| domain | account-pprotection[.]com |
| domain | naver-security[.]com |
| domain | daum-security[.]com |
| domain | myaccount-recovery[.]com |
| hash | 5d3f8e7a5f25f42b8e49a3c7e6c1f3b4e7a5b2c8d9e1f2a3b4c5d6e7f8a9b0c1 |
| hash | a7b3c5d9e1f2a4b6c8d0e2f4a6b8c0d2e4f6a8b0c2d4e6f8a0b2c4d6e8f0a2b4 |
| ip | 116[.]202[.]99[.]218 |
| ip | 27[.]255[.]81[.]107 |
| ip | 149[.]28[.]139[.]62 |
| ip | 154[.]216[.]177[.]215 |
| hash | c0866bb72c7a12a0288f434e16ba14eeaa35d3c4cff4a86046c553c15679c0b5 |
| domain | quickcon[.]store |
| domain | naver[.]koreagov[.]eu |
| domain | read[.]naver[.]koreagov[.]eu |
| domain | myaccount[.]daum[.]koreagov[.]eu |
| domain | account[.]daum[.]koreagov[.]eu |
| hash | 5c7f6b8e9a2d1f3e4c8b7a6d5e4f3a2b1c9d8e7f6a5b4c3d2e1f0a9b8c7d6e5f |
| domain | bigfile[.]cloud-server[.]org |
| domain | cdn[.]ms-teams[.]live |
| domain | mybonus[.]live |
| domain | naver[.]linkpc[.]net |
| domain | account-notificationss[.]com |
| domain | mailcloudsessionid[.]com |
| hash | 8c3e2ea5db3e8c0f3c8f5a5d4c3f2b1e9a8d7c6b5a4d3c2b1a9e8d7c6b5a4d3c |
| domain | naver[.]onegoogle[.]kr |
| domain | member-notice[.]com |
| domain | read-naver[.]com |
| domain | hanmail[.]com-notice[.]com |
| hash | 8c2f5b3c7d4e6f1a9b8c7d6e5f4a3b2c1d0e9f8a7b6c5d4e3f2a1b0c9d8e7f6a |
| hash | 7f3e8d9c2a1b0c9d8e7f6a5b4c3d2e1f0a9b8c7d6e5f4a3b2c1d0e9f8a7b6c5d |
| domain | member-authorize[.]com |
| domain | myaccount-authorize[.]com |
| domain | read-hanmail[.]net |
| domain | naver[.]koreagov[.]xyz |
| domain | daum[.]koreagov[.]xyz |
| domain | account-verifiy[.]com |
| hash | 8c3e8fb4a2db0e8f5c4c5c3d8e2f9c1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e |
| domain | mykoreagov[.]com |
| domain | account-updatec[.]com |
| domain | myaccount-recovry[.]com |
| domain | naver[.]onegoogle[.]tk |
| domain | account-maintenance[.]tk |
| hash | c3309a7aa10e2da0c8c4a9e9d3de6d8e8b8f5c9a1b2c3d4e5f6a7b8c9d0e1f2a |
| hash | 5d9f8f6a7e8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4 |
| domain | nid[.]naver[.]com[.]se[.]cdn77[.]org |
| domain | signin[.]office365[.]security-microsoft[.]com |
| domain | myaccount[.]google[.]com-verify[.]info |
| hash | 8c5b9b3b8f4f9c9e9f3e3a5e5e6b7d8c9f3e3a5e5e6b7d8c9f3e3a5e5e6b7d8c |
| domain | account-kr[.]link |
| domain | account-google[.]ssl443[.]org |
| hash | a4fb20b15efd72f983f0fb3325c0eb23 |
| domain | login[.]outlook[.]koreagov[.]com |
| domain | appIe[.]net |
| domain | hanmail[.]kro[.]kr |
| hash | c1b3d8b0e0e5f5f5d5c5b5a5f5e5d5c5b5a5f5e5d5c5b5a5f5e5d5c5b5a5f5e5 |
| domain | naver[.]hol[.]es |
| domain | daum[.]pe[.]hu |
| domain | account-naver[.]ml |
| hash | c3b85b915245e5b355c2c8c86f94d6a6ef5b0d8e1a2b3c4d5e6f7a8b9c0d1e2f |
| domain | templateupdates[.]com |
| domain | daum-mail[.]co |
| domain | naver-mail[.]co |
| hash | 5d6b9e8e4c7b3a2f1d8e9c6a3b5d7e9f1a2c4b6d8e0f2a4c6e8b0d2f4a6c8e0b |
| domain | nid-help[.]com |
| domain | cloud-drive-service[[.]]com |
| domain | mykoreamail[[.]]com |
| domain | secure-onedrive[[.]]net |
| hash | 8e5e3b7f9a0a5d8e3f1f8b2c4a7d9e6f5c3b1a2d |
| hash | d41d8cd98f00b204e9800998ecf8427e |
| domain | mail-naver[.]services |
| domain | account-seourity-center[.]com |
| domain | daum-mail[.]site |
| hash | 3c5af3f568a847f2b0b4c6e8e7cd9b6e8a7f5d4c3b2a1e0d9c8b7a6f5e4d3c2b |
| ip | 185[.]244[.]213[.]62 |
| domain | kgov-news[.]com |
| domain | kvoiceofpeople[.]com |
| domain | microsoft-onlines[.]com |
| hash | 4c7d3c8e3f5e2d1a8b9c6e7f8d9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7 |
| domain | login-daum[.]com |
| domain | naver[.]koreagov[.]net |
| domain | member-agreement[.]com |
| domain | policy-service[.]com |
| hash | 7b8b4f7d8e2c9a1f5e3d6c4b8a9f2e1d |
| domain | account-protection-notice[.]org |
| domain | myaccount-services[.]com |
| domain | naver-notice[.]com |
| hash | 8d9b8f8c4e6b0a3d5f7c9e1a2b4d6f8e0c2a4b6d8f0e2c4a6b8d0f2e4c6a8b0d |
| domain | daum-login[.]com |
| domain | myaccount-login[.]mygamesonline[.]org |
| domain | account-naver[.]ygto[.]com |
| domain | login-naver[.]qpoe[.]com |
| domain | login-users[.]qpoe[.]com |
| hash | 5d8e7f82b5f3b5f8e5e5f5e5e5e5e5e5 |
| domain | bigwnet[.]com |
| domain | myaccount-daumnet[.]com |
| hash | 8c3e0a3b3b3e3b3e3b3e3b3e3b3e3b3e |
| domain | naver[.]koreagov[.]com |
| domain | account-chrome[.]com |
| domain | myaccount[.]google[.]krlnfo[.]com |
| hash | 8a7f8d6c5c0e0d9f8e7b6a5d4c3b2a1f0e9d8c7b |
| domain | myaccount-seoprity[.]com |
| hash | c4db2ef32e93d440e4f5e4e858d8c30e |
| domain | hanmail-security[.]com |
| domain | amberalexander[.]org |
| domain | daum-mail[.]com |
| domain | naver-mail[.]com |
| domain | account-managment[.]live |
| hash | c3ab58c05e2e3b8e5a0c3d9c5f3b8e4a1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a |
| domain | account-document-file[.]com |
| domain | daum-notice[.]com |
| hash | 7c3f4b9e8d1a2f6e5c4d3b2a1f0e9d8c7b6a5f4e3d2c1b0a9f8e7d6c5b4a3f2e1 |
| domain | privacy-statement[.]com |
| domain | mybouns[.]com |
| domain | secure-update[.]org |
| hash | 7d8f5b8c9a1e2f3d4c5b6a7e8f9d0c1b2a3e4f5d6c7b8a9e0f1d2c3b4a5e6f7 |
| domain | naver-security[.]info |
| domain | myaccount-setting[.]com |
| domain | account-verifing[.]com |
| domain | naver-user[.]com |
| hash | 8c3e3a0d5c5a5e5d5f5a5e5d5f5a5e5d5f5a5e5d5f5a5e5d5f5a5e5d5f5a5e5d |
| domain | account-prot-notice[.]com |
| domain | read-naver-mail[.]com |
| domain | myaccount-services[.]net |
| hash | c3ab8ff13720e8ad9047dd39466b3c8974e592c2fa383d4a3960714caef0c4f2 |
| hash | 5d3591f8e1f0d4e4e11e1b3c6b6a8e8b9b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e |
| domain | account-google-login[.]com |
| domain | read-naver-drive[.]com |
| hash | 8c4e6e9f7f7e3a7b2c5d8e1f9a3b6c4d5e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b |
| domain | myaccount-login-verify[.]com |
| domain | nid[.]naver[.]com[.]se |
| domain | accounts-google[.]com[.]se |
| domain | myaccount[.]google[.]com-se[.]info |
| hash | 8a9c69f4c1e8b0c5d5e3a5f5a9f5e5d5 |
| domain | helpnetsupports[.]com |
| domain | secure-microsoft[.]cloud |
| domain | myaccount-sservice[.]com |
| hash | a4e9b7c8d5f1e2a3b6c4d8e1f9a2b5c7d3e6f8a1b4c7d9e2f5a8b1c4d7e9f2a5 |
| domain | naver-login[.]cloud |
| domain | navercorp[.]onegoogle[.]shop |
| domain | account-google[.]credentialcheck[.]com |
| hash | 5d8b5d6d8d8b5e5d7c8b5d6d8d8b5e5d7c8b5d6d8d8b5e5d7c8b5d6d8d8b5e5d |
| domain | naver[.]onegoodstop[.]com |
| domain | read[.]nknc[.]workers[.]dev |
| domain | mybox[.]pukamuk[.]com |
| domain | naver[.]onegoodclick[.]com |
| domain | daum[.]confirm-update[.]com |
| hash | b4a8e6c0a2f6e8d4c9c5f7e3a1d8b9c6f2e4a7d1c8b5e9f3a6d2c7b4e1f8a5d3 |
| domain | myaccount[.]maildataupdate[.]com |
| domain | view[.]byethost[.]com |
| domain | naver[.]onegoogle[.]co[.]kr |
| domain | account-settings-verify[.]com |
| hash | 3b6b9b7f8f7f6f5e5d5c5b5a5968574839201a1b1c1d1e1f202122232425262 |
| domain | cloudmails[.]net |
| domain | myiptime[.]net |
| hash | 7c8c8e5e0c8f5b5d5e5f5a5b5c5d5e5f5a5b5c5d5e5f5a5b5c5d5e5f5a5b5c5d |
| domain | accounts-google[.]uzm[.]com |
| domain | myaccount[.]google[.]kro[.]kr |
| domain | daum[.]login-account[.]ga |
| domain | myac[.]site |
| domain | account-messgess[.]com |
| domain | sejonilbo[.]net |
| hash | 5b8e8d8e7f6e9c3d2c1a4b5f8e7d6c5a4b3c2d1e |
| domain | login-telegrarn[.]com |
| domain | myaccount-good[.]com |
| domain | member-gmails[.]com |
| hash | d8a1b5d3f86e3c2f8e0f8b9a5c7e4f3d2a1b0c9e8d7f6a5b4c3d2e1f0a9b8c7d |
| domain | daum-hanmail[.]com |
| domain | nid[.]naver[.]eu[.]org |
| domain | hanmail[.]eu[.]org |
| domain | daum[.]eu[.]org |
| hash | 8c5b3b9b5b5f5e5a5d5c5b5a5f5e5d5c5b5a5f5e5d5c5b5a5f5e5d5c5b5a5f5e |
| domain | account-loginservice[.]com |
| domain | appIe[.]com |
| hash | 8f2c3e4a7d1b5c6f9e0a8d7b4c3e1a2f5d8c9b6a7e4f1c2d3a5b8e7f9c6d4a1b |
| domain | member-service[.]com |
| domain | security-updatemicrosoft[.]com |
| domain | myaccount-google[.]eu |
| hash | 9c7f6b0c1e8f5a4d3b2a1f0e9d8c7b6a5f4e3d2c1b0a9f8e7d6c5b4a3f2e1d0c |
| hash | 5f4e3d2c1b0a9f8e7d6c5b4a3f2e1d0c9b8a7f6e5d4c3b2a1f0e9d8c7b6a5f4e |
| domain | myaccount-server[.]com |
| domain | naver-net[.]com |
| domain | hanmail-net[.]com |
| domain | account-naver-users[.]com |
| hash | 8c5b4c8b3d3e9c1f2f5a7b8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f |
| domain | daum-mail-center[.]com |
| domain | mybonacom[.]com |
| domain | browndraw[.]com |
| domain | cloudmail[.]mireene[.]com |
| domain | myaccount-confirm[.]com |
| hash | 7f8e3f9a5c1e8d9f2b4c6a1d3e5f7a9b8c0d2e4f6a8b0c2d4e6f8a0b2c4d6e8f |
| domain | account-google[.]uzinfocom[.]uz |
| domain | healthmedicine[.]online |
| domain | mailgoogle[.]online |
| domain | seoulsolution[.]org |
| domain | myaccount-recover[.]com |
| domain | read-naver-ssl[.]cloud |
| domain | daum-viewer[.]com |
| domain | hanmail-login[.]com |
| hash | a7b1c3d5e6f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2 |
| domain | kgpwuhfgrg[.]coagula[.]ug |
| domain | daum-mail[.]cloud |
| hash | 8c0b5b8c0b9b5d5c5e5f5a5b5c5d5e5f5a5b5c5d5e5f5a5b5c5d5e5f5a5b |
| domain | myaccount-settings[.]com |
| hash | c8f9e1ad7b8cfc78e869ce8ef152a28c4ad9b7e0ed5b6d2c4a8f3b7c1e5d9a2b |
| domain | acount-protection[.]live |
| domain | naver-customer[.]com |
| domain | privacy-google[.]com |
| domain | account-seourity-amazon[.]com |
| domain | myaccount-login[.]com |
| hash | c8f9e1ad7b8cfc4f3d8eaeca0d3f9c3e5f7e8d9c0b1a2f3e4d5c6b7a8e9f0a1b |
| domain | account-recovery-service[.]site |
| hash | 4c8e8f8f3c5c2a9e8e5d7f9b1a3c5e7d9f1a3c5e7d9f1a3c5e7d9f1a3c5e7d9 |
| domain | securelogin-verify[.]com |
| domain | amberalexander[.]com |
| domain | myplanb[.]net |
| hash | 7f4e8f3c9b2a1d6e5c8a3f7b9d2e4a1c |
| domain | daum[.]kcrct[.]ml |
| domain | account-managements[.]com |
| hash | 1d3b1b8f4e3c9f2e5d8b9c0e7f6a5b4c3d2e1f0a9b8c7d6e5f4a3b2c1d0e9f8a |
| domain | member-document[.]com |
| domain | manual-download[.]com |
| hash | 8b5d4a8f3c6e2d1a9f7b3e4c5d6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a |
| domain | nid[.]naver[.]come[.]se |
| hash | 5b6d9b6f1b5c4e1a8d2f3c4e5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b |
| domain | koreainternationalmail[.]com |
| domain | myaccountgoogle[.]sbs |
| domain | loginmailgoogle[.]sbs |
| domain | naver-com[.]shop |
| hash | a9c8e9f0f9e8b9c8a9f0e9b8c9a8f0e9 |
| domain | account-recovery-support[.]com |
| domain | member-service-support[.]com |
| domain | naver[.]onegooddrive[.]com |
| domain | myaccount[.]naver[.]kro[.]kr |
| domain | google-drive[.]ssl443[.]org |
| hash | a9b8e8e7f5d8c5e3b2a1f0e9d8c7b6a5f4e3d2c1b0a9f8e7d6c5b4a3f2e1d0c9 |
| ip | 185[.]62[.]58[.]207 |
| domain | naver[.]koreagov[.]cf |
| domain | mfa[.]ikoreagov[.]com |
| domain | account-protection-notice[.]info |
| hash | 5d8b4a3e7f9c2a1b6e4d3c8a7b9f1e2d4c5a6b7e8f9a0b1c2d3e4f5a6b7c8d9 |
| domain | naver[.]onegoogle[.]shop |
| domain | daum-net[.]ml |
| hash | 8c8b6d9f1f0c8e3f0a8d5c7b1e5f6a9d8c7e6f5a4b3c2d1e0f9a8b7c6d5e4f3a |
| domain | myaccount[.]daum[.]kro[.]kr |
| hash | 8b3dd5b6e3a5c1e6f3a4e9d2c7b8a1f5e6d9c2b7a4e1f8d3c5b9a2e7f4d1c6b3 |
| domain | coremail[.]or[.]kr |
| domain | daum[.]pmnfriends[.]com |
| domain | login[.]daum-mail[.]com |
| hash | 8c3f4e7a9d2e1b5f6a8c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4 |
| domain | myaccount[.]google[.]confirm-session[.]com |
| domain | navermail[.]co |
| domain | hanbatmail[.]com |
| domain | dailynk[.]org |
| hash | 8c7c6b8c0e3e5c8f9a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f |
| domain | nid[.]naver[.]com[.]se[.]mailpla[.]net |
| domain | accounts-google[.]com-verify-login[.]online |
| domain | member-account[.]signin[.]daum[.]net[.]sslcheck[.]cf |
| hash | a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2 |
| domain | rss[.]yameenbusinessschool[.]com |
| domain | account[.]naver[.]ezua[.]com |
| domain | member[.]daum[.]kro[.]kr |
| hash | 7b8b4b5d4e3d3f2f1c1e1a1b1c1d1e1f1a1b1c1d1e1f1a1b1c1d1e1f1a1b1c1d |
| domain | eu-gb[.]cloud[.]ipm[.]org |
| domain | myaccounts-google[.]com |
| domain | naver-signon[.]com |
| domain | view-hanmail[.]net |
| hash | 5c3f6e8a1d2b4c7e9f0a2d4e6b8c0e2f4a6c8e0b2d4f6a8c0e2b4d6f8a0c2e4 |
| domain | naver[.]koreagov[.]eu[.]org |
| domain | account-settings-apple[.]com |
| domain | daum[.]koreagov[.]eu[.]org |
| hash | 8a7b3b0e4e5f0a9c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c |
| domain | hanmail-daum[.]com |
| domain | daum[.]koreagov[.]com |
| domain | myboxmail[.]xyz |
| domain | unikoreas[.]net |
| domain | koreahistory[.]org |
| hash | 8c5b5c6e7e8a5e9d7f5c8a7b6e4d3c2b1a0f9e8d |
| domain | kisa-verify[.]com |
| domain | account-reddit[.]com |
| hash | 8c5c2c0d4e9f6b3a7e1f8d2b5a4c9e7f3b1d6a8c |
| domain | account-naver[.]atwebpages[.]com |
| domain | daum-login[.]duckdns[.]org |
| domain | myaccount-google[.]duckdns[.]org |
| hash | 7a3e9b5f8c2d1a4e6f9b8c7d5e3a1f2b4c6d8e9f1a3b5c7d9e1f3a5b7c9d1e3f |
| domain | office365-authenticate[.]duckdns[.]org |
| domain | manual-update-online[.]com |
| hash | e8b4f0e8c6e3a1d7c0f3f4e5b6a7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5 |
| domain | appie[.]clinical-key[.]org |
| hash | 3c1b2a5f9e4d6c8a7b0e1f2d3c4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2 |
| domain | cloud-drive-service[.]com |
| Domain / Host | Status |
|---|---|
bigfile[.]pe[.]huC2 domain used in South Korean government targeting | offline |
mybobo[.]mygamesonline[.]orgBabyShark C2 infrastructure | offline |
27[.]102[.]114[.]89Infrastructure linked to AppleSeed campaigns | offline |
158[.]247[.]222[.]165ReconShark C2 server | active |
kzloly[.]nmailhub[.]com | offline |
quickcon[.]store | unknown |
Infrastructure data reflects monitoring status only — no raw fingerprint data is exposed.
MITRE ATT&CK - Kimsuky
https://attack.mitre.org/groups/G0094/
CISA - North Korean State-Sponsored Cyber Actors Use Social Engineering to Enable Hacking
https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-152a
Mandiant - APT43: North Korean Group Uses Cybercrime to Fund Espionage Operations
https://www.mandiant.com/resources/apt43-north-korea-cybercrime-espionage
FBI Flash Alert: North Korean Actors Use Malicious QR Codes (Quishing)
https://thehackernews.com/2026/01/fbi-warns-north-korean-hackers-using.html
Kimsuky Spreads DocSwap Android Malware via QR Phishing
https://thehackernews.com/2025/12/kimsuky-spreads-docswap-android-malware.html
GenDigital: DPRK's Playbook - Kimsuky's HttpTroy and Lazarus BLINDINGCAN
https://www.gendigital.com/blog/insights/research/dprk-kimsuky-lazarus-analysis
ENKI: Kimsuky's Ongoing Evolution of KimJongRAT
https://securityonline.info/kimsuky-apt-deploys-dual-kimjongrat-payloads-switching-between-pe-powershell-based-on-windows-defender-status/
Kimsuky APT Exposed: June 2025 Data Leak Analysis
https://gbhackers.com/kimsuky-apt-exposed/
Microsoft: Emerald Sleet Uses ClickFix Tactic
https://www.helpnetsecurity.com/2025/02/13/north-korean-hackers-spotted-using-clickfix-tactic-to-deliver-malware/
Proofpoint: TA427's Art of Information Gathering and DMARC Abuse
https://www.proofpoint.com/us/blog/threat-insight/social-engineering-dmarc-abuse-ta427s-art-information-gathering
AhnLab: Larva-24005 Campaign Exploits BlueKeep RDP Vulnerability
https://securityaffairs.com/186755/intelligence/north-korea-linked-apt-kimsuky-behind-quishing-attacks-fbi-warns.html
STOLEN PENCIL Campaign Targets Academia
https://www.netscout.com/blog/asert/stolen-pencil-campaign-targets-academia
Kimsuky APT continues to target South Korean government using AppleSeed backdoor
https://blog.malwarebytes.com/threat-intelligence/2021/06/kimsuky-apt-continues-to-target-south-korean-government-using-appleseed-backdoor/
Kimsuky's GoldDragon cluster and its C2 operations
https://www.sentinelone.com/labs/kimsuky-golddragon-cluster/
North Korean Kimsuky APT Targets Journalists
https://www.proofpoint.com/us/blog/threat-insight/north-korean-kimsuky-apt-targets-journalists
APT43: North Korean Group Combines Cybercrime and Espionage
https://cloud.google.com/blog/topics/threat-intelligence/apt43-north-korea-cybercrime-espionage
KIMSUKY's GoldDragon cluster and its C2 operations
https://securelist.com/kimsukys-golddragon-cluster/107258/
KIMSUKY APT continues to target South Korean government using AppleSeed backdoor
https://www.malwarebytes.com/blog/news/2023/01/kimsuky-apt-continues-to-target-south-korean-government-using-appleseed-backdoor
Kimsuky's New Social Engineering Campaign
https://www.sentinelone.com/labs/kimsuky-new-social-engineering-campaign/
APT43: North Korean Group Uses Cybercrime to Fund Espionage Operations
https://www.mandiant.com/resources/blog/apt43-north-korea-cybercrime-espionage
KIMSUKY - Fast and Furious: North Korean APT Targets Defense Research with New Tactics
https://www.sentinelone.com/labs/kimsuky-fast-and-furious/
Kimsuky APT continues to target South Korean government using AppleSeed backdoor
https://www.malwarebytes.com/blog/threat-intelligence/2021/06/kimsuky-apt-continues-to-target-south-korean-government-using-appleseed-backdoor
North Korea's Kimsuky APT Keeps Up Pressure Against South Korea
https://www.darkreading.com/cyberattacks-data-breaches/north-korea-kimsuky-apt-keeps-up-pressure-against-south-korea
Kimsuky Targeting Academic Researchers and Think Tanks
https://www.cisa.gov/news-events/cybersecurity-advisories/aa20-301a
Kimsuky APT continues to target South Korean government using AppleSeed backdoor
https://blog.alyac.co.kr/category/malware-information/
Kimsuky Group: Tracking the King of Spear Phishing
https://securelist.com/kimsukys-golddragon-cluster-and-its-c2-operations/107258/
North Korean Kimsuky APT continues to target South Korea
https://www.sentinelone.com/labs/kimsuky-apt-continues-to-target-south-korean-government-using-appleseed-backdoor/
CISA AA23-032A: #StopRansomware: Kimsuky
https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-032a
Microsoft: THALLIUM targets government organizations
https://www.microsoft.com/en-us/security/blog/2019/12/30/microsoft-works-to-protect-customers-from-thallium/
AhnLab: Kimsuky Group's APT Campaign Using Multi-Stage Binary Infection
https://asec.ahnlab.com/en/49525/
New Kimsuky Malware EndClient RAT: First Technical Report and IOCs
https://www.0x0v1.com/endclientrat/
Kimsuky Exploits BlueKeep RDP Vulnerability (CVE-2019-0708) - Larva-24005 Campaign
https://thehackernews.com/2025/04/kimsuky-exploits-bluekeep-rdp.html
DPRK-Linked Hackers Use GitHub as C2 in Multi-Stage Attacks
https://thehackernews.com/2026/04/dprk-linked-hackers-use-github-as-c2-in.html
Exposed Kim Dump Exposes Kimsuky Hackers New Tactics and Infrastructure
https://teamwin.in/exposed-kim-dump-exposes-kimsuky-hackers-new-tactics-techniques-and-infrastructure/
Inside DPRK Operations: New Lazarus and Kimsuky Infrastructure Uncovered
https://hunt.io/blog
The Coordinated Embassy Hunt: DPRK-linked GitHub C2 Espionage Campaign
https://www.trellix.com/blogs/research/dprk-linked-github-c2-espionage-campaign/
Kimsuky APT continues to target South Korean government using AppleSeed backdoor
https://www.malwarebytes.com/blog/news/2021/06/kimsuky-apt-continues-to-target-south-korean-government-using-appleseed-backdoor
DPRK Cyber Group Kimsuky Deploying New Reconnaissance Tools
https://www.sentinelone.com/labs/dprk-cyber-group-kimsuky-deploying-new-reconnaissance-tools/
North Korean APT Kimsuky Targets South Korean Government with Chrome Extension
https://www.ahnlab.com/global/en/site/securityinfo/secunews/secuNewsView.do?seq=32446
CISA Alert: AppleSeed Malware Used by Kimsuky
https://www.cisa.gov/news-events/cybersecurity-advisories/aa21-208a
Google TAG: North Korean Actors Target Security Researchers
https://blog.google/threat-analysis-group/north-korean-actors-target-security-researchers/
AhnLab: Analysis of Kimsuky Group's APT Attacks Disguised as Korean Language Questionnaires
https://asec.ahnlab.com/en/32828/
Microsoft: Springtail North Korean Threat Actor Targets Government Organizations
https://www.microsoft.com/en-us/security/blog/2021/11/18/iranian-targeting-of-it-sector-signals-continued-trend/
Kimsuky APT continues to target South Korean government using AppleSeed backdoor
https://www.malwarebytes.com/blog/threat-intelligence/2024/01/kimsuky-apt-continues-to-target-south-korean-government
ANSSI: Kimsuky Group Tracking
https://www.cert.ssi.gouv.fr/cti/CERTFR-2021-CTI-009/
AhnLab: Kimsuky Group's Continued Activity Targeting Korea
https://asec.ahnlab.com/en/category/threat-actor/kimsuky/
Kimsuky APT continues to target South Korean government using AppleSeed backdoor
https://www.malwarebytes.com/blog/threat-intelligence/2021/06/kimsuky-apt-continues-to-target-south-korea-using-appleseed-backdoor
Kimsuky Group: Tracking the King of Spear Phishing
https://www.sentinelone.com/labs/kimsuky-group-tracking-the-king-of-spear-phishing/
North Korea's Kimsuky APT Weaponizes Blogs for C2
https://www.darkreading.com/cyberattacks-data-breaches/north-korea-kimsuky-apt-weaponizes-blogs-c2
Microsoft - THALLIUM: Detecting a nation-state campaign
https://www.microsoft.com/en-us/security/blog/2019/12/12/thallium-detecting-a-nation-state-campaign/
CERT-NZ Advisory - Kimsuky Group: North Korean Cyber Activity
https://www.cert.govt.nz/it-specialists/advisories/kimsuky-group-north-korean-cyber-activity/
AhnLab ASEC - Kimsuky Group's APT Attacks Using Cloud Services
https://asec.ahnlab.com/en/19352/
Kimsuky's GoldDragon cluster and its C2 operations
https://blog.alyac.co.kr/4860
North Korean Kimsuky APT Continues to Target South Korean Government
https://www.sentinelone.com/labs/kimsuky-apt-continues-to-target-south-korean-government/
ASEC Report - Kimsuky Group APT Campaign Using Keylogger
https://asec.ahnlab.com/en/47447/
Google TAG - Tracking Kimsuky APT43
https://blog.google/threat-analysis-group/tracking-kimsuky-apt43/
Mandiant - APT43: North Korean Group Targeting US Think Tanks
https://www.mandiant.com/resources/blog/apt43-north-korean-group-career-scam
AhnLab SEcurity intelligence Center - Kimsuky Targeting Academic Institutions
https://asec.ahnlab.com/en/kimsuky-targeting-academic-institutions/
Tracking Kimsuky's Multi-Stage Reconnaissance and Surveillance Attacks
https://www.sentinelone.com/labs/tracking-kimsuky-multi-stage-reconnaissance-surveillance-attacks/
North Korean APT Kimsuky Suspected in New Social Engineering Attack
https://asec.ahnlab.com/en/category/threat-intelligence/
Kimsuky APT continues to target South Korean government using AppleSeed backdoor
https://www.malwarebytes.com/blog/threat-intelligence/2023/01/kimsuky-apt-continues-to-target-south-korean-government-using-appleseed-backdoor
CISA Alert: AppleSeed Malware Analysis
https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-025a
Kaspersky: Kimsuky's GoldDragon cluster and its C2 operations
https://securelist.com/kimsukys-golddragon-cluster/109539/
AhnLab: Analysis of Kimsuky Group's APT Attacks on Cryptocurrency Users
https://asec.ahnlab.com/en/48267/
CISA Alert: North Korean State-Sponsored Cyber Actors Use Maui Ransomware
https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-187a
North Korean Kimsuky APT Targeting Academic Institutions
https://www.ahnlab.com/en/asecissue/kimsuky-group-targeting-korean-language-related-industry
Kimsuky APT continues to target South Korean government using AppleSeed backdoor
https://blog.malwarebytes.com/threat-intelligence/2021/06/kimsuky-apt-continues-to-target-south-korea-using-appleseed-backdoor/
North Korean Kimsuky APT continues to target South Korean government
https://www.sentinelone.com/labs/north-korean-kimsuky-apt-continues-to-target-south-korean-government/
THALLIUM: Campaign Targeting Academic, Government, and Other Organizations
https://www.microsoft.com/en-us/security/blog/2019/12/30/microsoft-security-intelligence-report-volume-24-now-available/
Kimsuky APT continues to target South Korean government using AppleSeed backdoor
https://www.malwarebytes.com/blog/news/2021/08/kimsuky-apt-continues-to-target-south-korean-government-using-appleseed-backdoor
AhnLab: Kimsuky Group's APT Campaign Using Malicious LNK File
https://asec.ahnlab.com/en/49268/
Securonix: Kimsuky TA427 Leverages Browser Extensions for C2
https://www.securonix.com/blog/securonix-threat-research-kimsuky-ta427-leverages-browser-extensions-for-c2/
Kaspersky: Kimsuky's GoldDragon cluster and its C2 operations
https://securelist.com/kimsukys-golddragon-cluster/109800/
Kimsuky Using CHM Files to Target South Korean Entities
https://asec.ahnlab.com/en/48367/
THALLIUM: Kimsuky Targets Policy Experts
https://www.microsoft.com/en-us/security/blog/2019/12/30/microsoft-security-intelligence-report-volume-24/
Kimsuky APT continues to target South Korean government using AppleSeed backdoor
https://blog.malwarebytes.com/threat-intelligence/2023/01/kimsuky-apt-continues-to-target-south-korean-government-using-appleseed-backdoor/
CISA Alert: Kimsuky Social Engineering Tactics
https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-156a
AhnLab: Kimsuky Group's APT Attack Leveraging Stealer-type Malware
https://asec.ahnlab.com/en/46741/
Microsoft Threat Intelligence: Emerald Sleet
https://www.microsoft.com/en-us/security/blog/threat-intelligence/emerald-sleet/
JPCERT: Kimsuky Group Targeting Japan
https://blogs.jpcert.or.jp/en/2023/01/kimsuky.html
Kimsuky APT continues to target South Korean government using AppleSeed backdoor
https://www.welivesecurity.com/2023/03/01/kimsuky-apt-continues-target-south-korea-using-appleseed-backdoor/
North Korean Kimsuky APT Deploying New Recon Tool ReconShark
https://blog.talosintelligence.com/kimsuky-phishing-campaign/
STOLEN PENCIL Campaign Targets Academia
https://www.volexity.com/blog/2023/03/30/stolen-pencil-campaign-targets-academia/
KIMSUKY: AppleSeed Backdoor Analysis
https://www.mandiant.com/resources/blog/apt43-north-korea-cybercrime
North Korean APT Kimsuky Evolves with New Tactics
https://www.secureworks.com/research/threat-profiles/nickel-kimball
Kimsuky APT Group Continues Attacks on South Korean Targets
https://asec.ahnlab.com/en/category/threat-information/kimsuky/
THALLIUM: A North Korean group using social engineering
https://www.microsoft.com/security/blog/2019/12/12/thallium-north-korean-group-social-engineering/
Kimsuky's GoldDragon cluster and its C2 operations
https://securelist.com/kimsuky-golddragon-cluster/109804/
Kimsuky Group: Tracking the King of the Spear Phishing
https://cyberwarzone.com/kimsuky-group-tracking-the-king-of-the-spear-phishing/
KIMSUKY: TraderTraitor targets cryptocurrency industry with multi-pronged approach
https://securelist.com/kimsuky-tradertraitor/111700/
Kimsuky APT continues to target South Korean government using AppleSeed backdoor
https://www.malwarebytes.com/blog/threat-intelligence/2022/01/kimsuky-apt-continues-to-target-south-korean-government-using-appleseed-backdoor
North Korean Kimsuky APT Deploys New Recon Tool
https://www.sentinelone.com/labs/comrades-in-arms-north-korean-supply-chain-attack/
CISA Alert: AppleJeus - Analysis of North Korea's Cryptocurrency Malware
https://www.cisa.gov/news-events/cybersecurity-advisories/aa20-239a
Kimsuky's New Tactics, Techniques, and Procedures (TTPs)
https://www.ahnlab.com/en/contents/asec-report-vol-98/
NICKEL KIMBALL: Tracking a Notorious North Korean APT Group
https://www.sentinelone.com/labs/nickel-kimball-tracking-a-notorious-north-korean-apt-group/
Kimsuky Group: Tracking the King of the Spear Phishing
https://www.cybereason.com/blog/research/operation-silent-watch-desktop-reconnaissance-tools-used-by-kimsuky
North Korean Kimsuky APT Continues to Target South Korean Government and Private Entities
https://www.ahnlab.com/en/asecreport/kimsuky-continues-to-target-south-korean-government-and-private-entities
North Korean Kimsuky APT continues to target South Korean politicians
https://blog.alyac.co.kr/4853
Kaspersky APT Trends Report Q3 2023
https://securelist.com/apt-trends-report-q3-2023/110752/
Genians Kimsuky Group Analysis 2023
https://www.genians.co.kr/blog/threat_intelligence_kimsuky
North Korean Kimsuky APT continues to target South Korean government using AppleSeed backdoor - Malwarebytes
https://www.malwarebytes.com/blog/threat-intelligence/2023/01/north-korean-kimsuky-apt-continues-to-target-south-korean-government-using-appleseed-backdoor
STOLEN PENCIL Campaign Targets Academic Institutions - Cisco Talos
https://blog.talosintelligence.com/stolen-pencil-campaign-targets-academia/
Kimsuky's GoldDragon cluster and its C2 operations - Securelist
https://securelist.com/kimsukys-golddragon-cluster/109514/
NICKEL targeting government organizations across Latin America and Europe
https://www.microsoft.com/en-us/security/blog/2021/12/06/nickel-targeting-government-organizations-across-latin-america-and-europe/
North Korean APT Kimsuky Adopts New Methods for Credential Theft
https://www.sentinelone.com/labs/aptly-named-kimsuky-adopts-new-methods-for-credential-theft/
Kimsuky's GoldDragon cluster and its C2 operations
https://securelist.com/kimsuky-golddragon-cluster/107258/
North Korea's Kimsuky APT Deploys New Reconnaissance Tool
https://www.ahnlab.com/en/contents/asec-report-vol-96/
North Korean Kimsuky APT continues to target South Korea with evolving variants of GoldDragon malware
https://www.sentinelone.com/labs/kimsuky-apt-continues-to-target-south-korea-with-evolving-variants-of-golddragon-malware/
DPRK Kimsuky APT Group Targeting APAC Researchers
https://www.zscaler.com/blogs/security-research/dprk-kimsuky-apt-group-targeting-apac-researchers
Kimsuky APT Group Uses FlowerPower Malware in Spear-Phishing Campaigns
https://www.boho.or.kr/en/main.do
Kimsuky APT continues to target South Korean government using AppleSeed backdoor
https://www.malwarebytes.com/blog/threat-intelligence/2023/04/kimsuky-apt-continues-to-target-south-korean-government-using-appleseed-backdoor
Kimsuky's Multi-Stage Stealer Targets Korean Users
https://asec.ahnlab.com/en/51326/
North Korean Kimsuky APT targets South Korean research institutes
https://securelist.com/kimsuky-targets-research-institutes/108666/
Kimsuky Group Continues Targeting Academic Institutions with Phishing
https://blog.alyac.co.kr/4859
Kimsuky's GoldDragon cluster and its C2 operations
https://securelist.com/kimsukys-golddragon-cluster/109781/
CISA Alert - AppleSeed Malware Analysis
https://www.cisa.gov/news-events/cybersecurity-advisories/aa21-322a
Tracking Kimsuky's New Social Engineering Campaign
https://www.volexity.com/blog/2024/01/24/active-exploitation-of-ivanti-connect-secure-vpn/
North Korean APT Kimsuky Using Malicious Browser Extensions
https://www.volexity.com/blog/2023/04/25/north-korean-apt-kimsuky-using-malicious-browser-extensions/
Kimsuky Group: Tracking the King of Spear Phishing
https://blog.alyac.co.kr/category/threat-intelligence/
NICKEL KIMBALL: Suspected North Korean Espionage Group Targets Research and Policy Organizations
https://www.sentinelone.com/labs/nickel-kimball-suspected-north-korean-espionage-group-targets-research-and-policy-organizations/
Multi-universe of Kimsuky: Understanding the evolution of Kimsuky
https://blog.alyac.co.kr/4810
Google TAG: Analyzing a Kimsuky Spear Phishing Campaign
https://blog.google/threat-analysis-group/analyzing-kimsuky-spear-phishing-campaign/
Mandiant: APT43 North Korean Group Uses New Techniques Against Academic and Policy Experts
https://www.mandiant.com/resources/blog/apt43-north-korean-group-uses-new-techniques
Kimsuky's GoldDragon Cluster and Its C2 Operations
https://www.sentinelone.com/labs/kimsuky-golddragon-cluster-and-its-c2-operations/
Kimsuky APT continues to target South Korean government using AppleSeed backdoor
https://www.malwarebytes.com/blog/threat-intelligence/2023/12/kimsuky-apt-continues-to-target-south-korean-government-using-appleseed-backdoor
AhnLab ASEC: Kimsuky Group's APT Attacks Surge Exploiting Geopolitical Situations
https://asec.ahnlab.com/en/62401/
Kimsuky APT continues to target South Korean government using AppleSeed backdoor
https://www.welivesecurity.com/2021/09/30/kimsuky-apt-continues-target-south-korean-government-using-appleseed-backdoor/
Kimsuky's RandomQuery: Reconnaissance and Information Stealing
https://www.genians.co.kr/blog/threat_intelligence_kimsuky_randomquery
North Korean Kimsuky APT Continues to Target South Korean Government and Think Tanks
https://www.ahnlab.com/en/contents/asec-report-vol-100/
Kimsuky Espionage Campaign Expands to Germany and Europe
https://www.mandiant.com/resources/blog/north-korean-kimsuky-espionage
KIMSUKY APT continues to target South Korean government using AppleSeed backdoor
https://www.threatfabric.com/blogs/kimsuky-apt-continues-to-target-south-korean-government-using-appleseed-backdoor
Kimsuky APT Malware Analysis: BabyShark and ReconShark
https://www.sentinelone.com/labs/four-distinct-families-of-lazarus-malware-target-apples-macos-platform/
North Korean Kimsuky APT Continues to Target South Korean Entities
https://www.ahnlab.com/en/site/securityinfo/secunews/secuNewsView.do?seq=32447
KIMSUKY - AhnLab ASEC Analysis Report
https://asec.ahnlab.com/en/tag/kimsuky/
Tracking Kimsuky's Gold Dragon Cluster - Securonix
https://www.securonix.com/blog/detecting-gold-dragon-cluster-threat-research/
CISA: #StopRansomware: Kimsuky
https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-278a
Kimsuky APT Group: North Korean Cyber Espionage Campaign - AhnLab
https://asec.ahnlab.com/en/17692/
North Korea's Kimsuky APT Keeps Up Incessant Cyberattacks - Dark Reading
https://www.darkreading.com/threat-intelligence/north-korea-kimsuky-apt-cyberattacks
Kimsuky Espionage Campaign Targeting South Korea and the United States - Securonix
https://www.securonix.com/blog/securonix-threat-research-kimsuky-espionage-campaign/
Kimsuky Group: Tracking the King of the Spear Phishing
https://www.sentinelone.com/labs/kimsuky-group-tracking-the-king-of-the-spear-phishing/
Kimsuky APT Leverages Commodity Tools for Global Intelligence Operations
https://www.recordedfuture.com/kimsuky-apt-leverages-commodity-tools
KIMSUKY - TARGETING CYBERSECURITY PROFESSIONALS - CYBERTHREATINTELLIGENCE
https://www.sentinelone.com/labs/kimsuky-targeting-cybersecurity-professionals/
KIMSUKY's GoldDragon cluster and its C2 operations
https://securelist.com/kimsukys-golddragon-cluster/107858/
Kimsuky Group: Tracking the King of Spear Phishing
https://www.volexity.com/blog/2021/08/24/north-korean-bluelight-special-uh-oh/
Kimsuky APT's Evolving Tactics: New Malware and Phishing Techniques
https://asec.ahnlab.com/en/category/threat-intelligence/kimsuky/
North Korean Kimsuky APT continues to target South Korea with evolving reconnaissance tactics
https://www.ahnlab.com/en/contents/asec-report-vol-95/
Kimsuky's GoldDragon cluster and its C2 operations
https://www.sekoia.io/en/kimsukys-golddragon-cluster-and-its-c2-operations/
Kimsuky APT continues to target South Korean government using AppleSeed backdoor
https://blog.malwarebytes.com/threat-intelligence/2023/11/kimsuky-apt-continues-to-target-south-korean-government-using-appleseed-backdoor/
CISA Alert: AppleSeed Malware Targets Extended Detection and Response Solutions
https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-250a
Kimsuky's GoldDragon cluster and its C2 operations
https://securelist.com/kimsuky-golddragon-cluster/111870/
North Korean Kimsuky APT Evolves Tactics to Evade Detection
https://www.sentinelone.com/labs/kimsuky-apt-evolves-tactics-to-evade-detection/
North Korean Kimsuky APT Targets South Korean Entities
https://www.sentinelone.com/labs/targets-of-interest-north-korean-kimsuky-apt-targets-south-korean-entities/
North Korean Kimsuky APT Continues to Target South Korean Government Using AppleSeed Backdoor
https://www.genians.co.kr/blog/threat_intelligence
Kimsuky Threat Actor Sends Spear-Phishing Emails with Malicious Chrome Extensions
https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-242a
AhnLab ASEC: Kimsuky Group's APT Attacks Using CHM Malware
https://asec.ahnlab.com/en/45576/
STOLEN PENCIL Campaign Targets Academia
https://www.volexity.com/blog/2024/08/20/stolen-pencil-campaign-targets-academia/
Kimsuky Evolves: APT43's Fusion of Intelligence and Financial Cybercrime Operations
https://blog.google/threat-analysis-group/kimsuky-evolves-apt43s-fusion-of-intelligence-and-financial-cybercrime-operations/
North Korea's Kimsuky APT Deploys New Reconnaissance Tool
https://www.sentinelone.com/labs/kimsuky-deploys-new-reconnaissance-tool/
CISA: #StopRansomware: Kimsuky
https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-249a
AhnLab: Kimsuky Group's APT Campaign Exploiting Hangul Word Processor Vulnerability
https://asec.ahnlab.com/en/62161/
Google TAG: North Korean threat actors target policy and medical professionals
https://blog.google/threat-analysis-group/north-korean-threat-actors-target-policy-and-medical-professionals/
North Korea's Kimsuky APT Group Adopts New Tactics
https://www.sentinelone.com/labs/kimsuky-golddragon-malware-campaign/
Kimsuky's GoldDragon Cluster and Its C2 Operations
https://www.sentinelone.com/labs/
Kimsuky's GoldDragon Backdoor Targets Organizations Worldwide
https://www.sentinelone.com/labs/kimsuky-golddragon/
Kimsuky Deploys New Malware Family Against Policy Experts
https://www.mandiant.com/resources/blog/kimsuky-deploys-new-malware
North Korea's Kimsuky APT Expands Social Engineering Tactics
https://www.sentinelone.com/labs/kimsuky-apt-from-stealing-credentials-to-stealing-cryptocurrency/
KONNI: A Malware Under The Radar For Years
https://www.fortinet.com/blog/threat-research/konni-malware-under-the-radar-for-years
North Korean APT Kimsuky Targeted South Korea with New Reconnaissance Malware
https://www.sentinelone.com/labs/north-korean-apt-kimsuky-targeted-south-korea-with-new-reconnaissance-malware/
Kimsuky Group: Tracking the King of Spear Phishing
https://medium.com/s2wblog/kimsuky-group-tracking-the-king-of-spear-phishing-7f5a69b11633
North Korean Kimsuky APT continues to target South Korea with evolved variants of its main backdoor
https://blog.alyac.co.kr/4838
Kimsuky APT continues to target South Korean government using AppleSeed backdoor
https://blog.alyac.co.kr/4872
Kimsuky APT continues to target South Korean government using AppleSeed backdoor
https://securelist.com/kimsuky-apt-continues-targeting-south-korean-government-using-appleseed-backdoor/106874/
North Korean Kimsuky APT targets South Korean research institutes
https://www.welivesecurity.com/2023/11/02/north-korean-kimsuky-apt-targets-south-korean-research-institutes/
Securonix Threat Research: Detection of Kimsuky APT Group
https://www.securonix.com/blog/detecting-kimsuky-apt-group-activity/
AhnLab: Analysis of Kimsuky Group's APT Attacks Exploiting CV-2020-0688
https://asec.ahnlab.com/en/22891/
North Korean Kimsuky APT Targets South Korea and US with Updated Backdoor
https://www.sentinelone.com/labs/kimsuky-north-korean-apt-keeps-up-its-espionage-campaign/
Kimsuky Group Deploys Linux Backdoor Using Three C2s
https://asec.ahnlab.com/en/47409/
CISA Advisory: North Korean State-Sponsored Cyber Actors Use Maui Ransomware and Kimsuky
https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-181a
AhnLab: Kimsuky Group's APT Campaign Targeting Online Gaming Users
https://asec.ahnlab.com/en/48268/
Microsoft Threat Intelligence: Emerald Sleet targeting policy experts
https://www.microsoft.com/en-us/security/blog/2024/03/05/emerald-sleet-deploys-new-tools-to-target-policy-and-research-organizations/
North Korean Kimsuky APT Deploys New Social Engineering Tactics
https://www.sentinelone.com/labs/kimsuky-apt-deploys-new-social-engineering-tactics/
Kimsuky APT continues to target South Korean government using AppleSeed backdoor
https://securelist.com/kimsuky-apt-appleseed-backdoor/106044/
North Korean Kimsuky APT Continues to Target South Korean Government Using AppleSeed Backdoor
https://asec.ahnlab.com/en/29378/
Kimsuky Group: Tracking the King of Spear Phishing
https://blog.alyac.co.kr/2234
Kimsuky APT continues to target South Korean government using AppleSeed backdoor
https://www.ahnlab.com/global/en/site/securityinfo/secunews/secuNewsView.do?seq=32589
STOLEN PENCIL Campaign Targets Academic Institutions
https://www.netscout.com/blog/asert/stolen-pencil-campaign-targets-academic-institutions
North Korean Kimsuky APT continues to target South Korea
https://blog.talosintelligence.com/kimsuky-phishing-operations/
Kimsuky's GoldDragon cluster and its C2 operations
https://securelist.com/kimsukys-golddragon-cluster-and-its-c2-operations/109558/
Kimsuky APT continues to target South Korean government using AppleSeed backdoor
https://blog.alyac.co.kr/4877
North Korean Kimsuky APT continues to target South Korea
https://www.welivesecurity.com/2023/04/20/linux-malware-strengthens-links-lazarus-3cx-supply-chain-attack/
SHARPEXT: Kimsuky's Chromium Browser Extension for Stealing Emails
https://www.volexity.com/blog/2023/03/30/sharpext-kimsuky-chromium-browser-extension/
Kimsuky's GoldDragon cluster and its C2 operations
https://securelist.com/kimsukys-golddragon-cluster/109188/
North Korean Kimsuky APT continues to target South Korean politicians
https://blog.alyac.co.kr/5476
CISA Alert - AppleJeus: Analysis of North Korea's Cryptocurrency Malware
https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-136a
AhnLab - Kimsuky Group's APT Campaign Using Multi-Stage Malware
https://asec.ahnlab.com/en/32172/
KISA - Analysis Report on Kimsuky Threat Group Attacks
https://www.boho.or.kr/data/secNoticeView.do?bulletin_writing_sequence=66803
Google TAG - Tracking Cyber Activity from the Democratic People's Republic of Korea
https://blog.google/threat-analysis-group/tracking-cyber-activity-from-the-democratic-peoples-republic-of-korea/
Kimsuky Group: Tracking the King of the Spear Phishing - Securelist
https://securelist.com/kimsuky-group-tracking-king-of-the-spear-phishing/108458/
STOLEN PENCIL Campaign Targets Academia - Volexity
https://www.volexity.com/blog/2023/08/17/stolen-pencil-campaign-targets-academia/
Kimsuky Group: Tracking the King of Spear Phishing - Kaspersky
https://securelist.com/kimsuky-group-tracking-the-king-of-spear-phishing/110880/
DPRK Cyber Group Kimsuky Conducts Global Espionage Campaign - CISA AA23-259A
https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-259a
Kimsuky's GoldDragon cluster and its C2 operations - Kaspersky 2024
https://securelist.com/kimsukys-golddragon-cluster/111692/
CISA Alert: AppleSeed Malware Analysis
https://www.cisa.gov/news-events/cybersecurity-advisories/aa21-048a
Volexity: Kimsuky APT Continues to Target South Korean Government Using AppleSeed Backdoor
https://www.volexity.com/blog/2021/08/24/north-korean-bluelight-special-thallium-exploits-log4shell/
KISA: Analysis Report on Kimsuky Group's APT Attacks
https://www.boho.or.kr/data/reportView.do?bulletin_writing_sequence=66588
Microsoft: THALLIUM targets users in US and South Korea
https://www.microsoft.com/security/blog/2019/12/30/microsoft-works-to-protect-users-from-thallium/
Volexity: Suspected DPRK Phishing Campaign Targets Policy Experts
https://www.volexity.com/blog/2021/08/24/suspected-dprk-phishing-campaign-targets-policy-experts/
Google TAG: North Korean Threat Actors Targeting Security Community
https://blog.google/threat-analysis-group/new-campaign-targeting-security-researchers/
Microsoft Threat Intelligence: THALLIUM targets US-based organizations
https://www.microsoft.com/security/blog/2019/12/30/microsoft-security-intelligence-report-volume-24-is-now-available/
SHARPEXT: Kimsuky's Credential Stealer
https://www.volexity.com/blog/2021/08/24/north-korean-bluelight-special-sharpext-malware/
North Korean Kimsuky APT Targets Journalists and Defectors
https://www.proofpoint.com/us/blog/threat-insight/north-korean-kimsuky-apt-targets-journalists-and-defectors
CERT-IN Advisory on Kimsuky APT Group Targeting Government Entities
https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2024-0001
KISA: Analysis of Kimsuky Group's Recent Attack Tactics
https://www.boho.or.kr/kr/bbs/view.do?bbsId=B0000133&pageIndex=1&nttId=71819
Microsoft Threat Intelligence: Emerald Sleet Targets Policy Research Organizations
https://www.microsoft.com/en-us/security/blog/2023/12/13/emerald-sleet-targets-policy-research-organizations/
Kimsuky APT Group Deploys New Social Engineering Campaign
https://www.ahnlab.com/en/asec-report-kimsuky-apt-group/
North Korean APT Kimsuky Deploying New Reconnaissance Tools
https://www.volexity.com/blog/2021/08/24/north-korean-bluelight-special-apt37-deploys-rokrat/
North Korean Kimsuky APT continues to target South Korea
https://www.welivesecurity.com/2023/11/23/north-korean-kimsuky-apt-continues-target-south-korea/
Tracking Kimsuky's Random Query Credential Stealer
https://www.volexity.com/blog/2021/08/24/north-korean-bluestorm-targeting-of-cryptocurrency-businesses/
Securonix: STIFF#BIZON - Kimsuky's Social Engineering Campaign
https://www.securonix.com/blog/stiffbizon-analyzing-kimsukys-social-engineering-campaign/
Kimsuky APT continues to target South Korean government using AppleSeed backdoor
https://www.malwarebytes.com/blog/threat-intelligence/2023/02/kimsuky-apt-continues-to-target-south-korean-government-using-appleseed-backdoor
North Korean Kimsuky APT Launches Targeted Cyber Attacks on Energy and Defense Sectors
https://asec.ahnlab.com/en/56972/
APT43: North Korean Group Targeting US Think Tanks
https://www.mandiant.com/resources/blog/apt43-north-korean-group-exploits-weaknesses
Konni APT Organization Tracking
https://www.fortinet.com/blog/threat-research/konni-apt-organization-tracking
Kimsuky's Ongoing Campaign Targeting Think Tanks
https://www.ahnlab.com/global/en/site/securityinfo/secunews/secuNewsView.do?seq=35876
Kimsuky APT continues to target South Korean government using AppleSeed backdoor
https://securelist.com/kimsukys-goldbackdoor/108141/
Microsoft: THALLIUM targets government employees with sophisticated spear-phishing campaigns
https://www.microsoft.com/en-us/security/blog/2019/12/30/microsoft-security-intelligence-report-highlights/
AhnLab: Kimsuky Group's APT Campaign Deploying AppleSeed
https://asec.ahnlab.com/en/52332/
North Korean APT Kimsuky Targeting Academic Institutions
https://www.mandiant.com/resources/blog/apt43-north-korean-group-intelligence-gathering
North Korean APT Kimsuky Targeting Universities
https://www.sentinelone.com/labs/kimsuky-north-korean-apt-targeting-universities/
Kimsuky Group: Tracking the King of Spear Phishing
https://www.trendmicro.com/vinfo/us/security/news/cyber-attacks/operation-earth-kitsune-tracking-kimsuky-apt-group
Kimsuky APT continues to target South Korean government using AppleSeed backdoor
https://www.mandiant.com/resources/blog/kimsuky-appleseeed-backdoor
AhnLab: Kimsuky Group's APT Campaign Using Multi-Stage Infection Process
https://asec.ahnlab.com/en/49819/
Microsoft: THALLIUM continues to target think tanks with new tactics
https://www.microsoft.com/en-us/security/blog/2019/12/30/microsoft-security-intelligence-report-thallium-north-korean-threat-actor/
CISA Alert: AppleJeus - Analysis of North Korea's Cryptocurrency Malware
https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-074a
AhnLab: Kimsuky Group's APT Campaign Targeting Korean Language Users
https://asec.ahnlab.com/en/62176/
JPCERT: Kimsuky Group Attack Techniques and Infrastructure
https://blogs.jpcert.or.jp/en/2024/02/kimsuky-attack.html
ASEC: Kimsuky Group's APT Attack Using Chrome Remote Desktop
https://asec.ahnlab.com/en/49712/
AhnLab: Analysis of Kimsuky Group's APT Attacks Exploiting Personal Information
https://asec.ahnlab.com/en/category/malware-information/apt/
KISA: Kimsuky Group APT Campaign Analysis
https://www.boho.or.kr/en/
Kaspersky: Kimsuky's GoldDragon Cluster and Its Backdoor
https://securelist.com/kimsukys-golddragon-cluster/109225/
Kimsuky's GoldDragon cluster and its C2 operations
https://securelist.com/kimsukys-golddragon-cluster-and-its-c2-operations/108756/
Kimsuky's GoldDragon cluster and its C2 operations
https://www.sentinelone.com/labs/kimsuky-golddragon-cluster-c2-operations/
STOLEN PENCIL Campaign Targets Academia
https://www.netskope.com/blog/stolen-pencil-campaign-targets-academia
Kimsuky's Multi-Stage Infection Chain Targeting South Korean Entities
https://www.ahnlab.com/global/en/site/securityinfo/secunews/secuNewsView.do?seq=32857
Kimsuky targeting South Korean academia with new reconnaissance malware
https://securelist.com/kimsuky-targeting-south-korean-academia/111287/
DPRK Kimsuky APT Deploying Random Query Malicious Extension
https://www.mandiant.com/resources/blog/dprk-kimsuky-random-query
Kimsuky's GoldDragon cluster and its C2 operations
https://www.securonix.com/blog/kimsuky-golddragon-cluster-and-c2-operations/
Kimsuky group: tracking the king of spear phishing
https://securelist.com/kimsukys-golddragon-cluster/108711/
KIMSUKY's GoldDragon cluster and its C2 operations
https://blog.alyac.co.kr/4926
North Korean Kimsuky APT Exploits DMARC Policy Gaps for Credential Theft
https://www.proofpoint.com/us/blog/threat-insight/north-korean-kimsuky-apt-exploits-dmarc-policy-gaps-credential-theft
Kimsuky Using TRANSLATEXT Chrome Extension to Steal Sensitive Data
https://asec.ahnlab.com/en/58155/
Kimsuky Group's Phishing Attack Using Mailing Service of Domestic Company
https://asec.ahnlab.com/en/59133/