Kimsuky
MISPNation-state
KP
Unknown
[Kimsuky](https://attack.mitre.org/groups/G0094) is a North Korea-based cyber espionage group that has been active since at least 2012. The group initially targeted South Korean government agencies, think tanks, and subject-matter experts in various fields. Its operations expanded to include the United Nations and organizations in the government, education, business services, and manufacturing sectors across the United States, Japan, Russia, and Europe. [Kimsuky](https://attack.mitre.org/groups/G0094) has focused collection on foreign policy and national security issues tied to the Korean Peninsula, nuclear policy, and sanctions. Its operations have overlapped with other DPRK actors, likely due to ad hoc collaboration or limited resource sharing.(Citation: EST Kimsuky April 2019)(Citation: Cybereason Kimsuky November 2020)(Citation: Malwarebytes Kimsuky June 2021)(Citation: CISA AA20-301A Kimsuky)(Citation: Mandiant APT43 March 2024)(Citation: Proofpoint TA427 April 2024) Because of overlapping operations, some researchers group a wide range of North Korean state-sponsored cyber activity under the broader [Lazarus Group](https://attack.mitre.org/groups/G0032) umbrella rather than tracking separate subgroup or cluster distinctions.
[Kimsuky](https://attack.mitre.org/groups/G0094) was assessed to be responsible for the 2014 Korea Hydro & Nuclear Power Co. compromise; other notable campaigns include Operation STOLEN PENCIL (2018), Operation Kabar Cobra (2019), and Operation Smoke Screen (2019).(Citation: Netscout Stolen Pencil Dec 2018)(Citation: EST Kimsuky SmokeScreen April 2019)(Citation: AhnLab Kimsuky Kabar Cobra Feb 2019)
In 2023, [Kimsuky](https://attack.mitre.org/groups/G0094) was observed using commercial large language models to assist with vulnerability research, scripting, social engineering and reconnaissance.(Citation: MSFT-AI)
Tecniche Utilizzate (109)
| ID | ATT&CK | Tattiche |
|---|---|---|
| T1003.001 | LSASS Memory | - |
| T1005 | Data from Local System | - |
| T1007 | System Service Discovery | - |
| T1012 | Query Registry | - |
| T1016 | System Network Configuration Discovery | - |
| T1021.001 | Remote Desktop Protocol | - |
| T1027 | Obfuscated Files or Information | - |
| T1027.001 | Binary Padding | - |
| T1027.002 | Software Packing | - |
| T1027.010 | Command Obfuscation | - |
| T1027.012 | LNK Icon Smuggling | - |
| T1027.016 | Junk Code Insertion | - |
| T1036.004 | Masquerade Task or Service | - |
| T1036.005 | Match Legitimate Resource Name or Location | - |
| T1036.007 | Double File Extension | - |
Riferimenti (10)
- securelist.com - 57915
- cfr.org - Kimsuky
- pwc.co.uk - Tracking Kimsuky North Korea Based Cyber Espionage Group Part 2
- youtu.be - HAsKp43AZmM
- bloomberglaw.com - X67FPNDOUBV9VOPS35A4864BFIU
- netscout.com - Stolen Pencil Campaign Targets Academia
- unit42.paloaltonetworks.com - New Babyshark Malware Targets U S National Security Think Tanks
- attack.mitre.org - G0086
- us-cert.cisa.gov - Aa20 301a
- cybereason.com - Back To The Future Inside The Kimsuky Kgh Spyware Suite
Alias (1758)
Malware Utilizzato (17)
Metadata
| ID: | 137 |
| Created: | 13/01/2026 17:48 |
| Updated: | 06/03/2026 04:00 |