State-backedNorth Korea MITRE G0094

Kimsuky

Also known as Velvet Chollima, Black Banshee, Thallium, Operation Stolen Pencil, G0086, APT43, Emerald Sleet, Springtail, Sparkling Pisces, TA427, Earth Kumiho, PatheticSlug

5mentions, 7 days

5mentions, 30 days

Nov 4, 2026last mentioned

This threat actor targets South Korean think tanks, industry, nuclear power operators, and the Ministry of Unification for espionage purposes.

Targets: Government, Private sector, Ministry of Unification, Sejong Institute, Korea Institute for Defense Analyses, Germany

CVEs in recent coverage

No CVEs named alongside this actor in the last 90 days.

Recent victims

No leak-site posts on record for this group.

ATT&CK techniques

T1003.001 LSASS Memory T1005 Data from Local System T1007 System Service Discovery T1012 Query Registry T1016 System Network Configuration Discovery T1020 Automated Exfiltration T1021.001 Remote Desktop Protocol T1027 Obfuscated Files or Information T1027.001 Binary Padding T1027.002 Software Packing T1027.007 Dynamic API Resolution T1027.010 Command Obfuscation T1027.012 LNK Icon Smuggling T1027.013 Encrypted/Encoded File T1027.015 Compression T1027.016 Junk Code Insertion T1033 System Owner/User Discovery T1036.004 Masquerade Task or Service T1036.005 Match Legitimate Resource Name or Location T1036.007 Double File Extension T1040 Network Sniffing T1041 Exfiltration Over C2 Channel T1053.005 Scheduled Task T1055 Process Injection T1055.001 Dynamic-link Library Injection T1055.012 Process Hollowing T1056.001 Keylogging T1056.003 Web Portal Capture T1057 Process Discovery T1059.001 PowerShell T1059.003 Windows Command Shell T1059.005 Visual Basic T1059.006 Python T1059.007 JavaScript T1070.004 File Deletion T1070.006 Timestomp T1071.001 Web Protocols T1071.002 File Transfer Protocols T1071.003 Mail Protocols T1074.001 Local Data Staging T1078.003 Local Accounts T1082 System Information Discovery T1083 File and Directory Discovery T1098.007 Additional Local or Domain Groups T1102.001 Dead Drop Resolver T1102.002 Bidirectional Communication T1105 Ingress Tool Transfer T1106 Native API T1111 Multi-Factor Authentication Interception T1112 Modify Registry T1113 Screen Capture T1114.002 Remote Email Collection T1114.003 Email Forwarding Rule T1115 Clipboard Data T1124 System Time Discovery T1132.002 Non-Standard Encoding T1133 External Remote Services T1136.001 Local Account T1140 Deobfuscate/Decode Files or Information T1176.001 Browser Extensions T1185 Browser Session Hijacking T1190 Exploit Public-Facing Application T1204.001 Malicious Link T1204.002 Malicious File T1204.004 Malicious Copy and Paste T1205 Traffic Signaling T1217 Browser Information Discovery T1218.005 Mshta T1218.010 Regsvr32 T1218.011 Rundll32 T1219.002 Remote Desktop Software T1480.002 Mutual Exclusion T1489 Service Stop T1497.001 System Checks T1505.003 Web Shell T1518.001 Security Software Discovery T1534 Internal Spearphishing T1539 Steal Web Session Cookie T1543.003 Windows Service T1546.001 Change Default File Association

Recent activity

References

From the MISP threat-actor galaxy, MITRE ATT&CK and RansomLook (CC BY 4.0). Activity is any post or advisory Watch Floor collected that names the actor or one of its aliases.