ThreatBox · Threat Actor Attribution
Kimsuky
a.k.a. Velvet Chollima, Thallium, Black Banshee, APT43
Espionage + Cryptocurrency theft North Korea (RGB — Reconnaissance General Bureau) First seen 2012
Kimsuky is a North Korean espionage group specialising in credential-phishing and intelligence gathering on Korean-peninsula policy. They pioneered 'benign' phishing chains that pretext as journalists, academics or NGO staff requesting interviews. Sub-cluster APT43 (Mandiant) blends espionage with cryptocurrency laundering to self-fund operations. Known for lightweight malware: BabyShark, ReconShark, AppleSeed, and abuse of PowerShell + Blogspot dead-drops.
Targeted sectors
Think tanksAcademiaJournalistsNGOsNuclear policy
Targeted regions
South KoreaUSAJapanEurope
Known TTPs (4)
T1566.001Spearphishing Attachment
T1566.002Spearphishing Link
T1102Web Service (blog dead-drops)
T1059.001PowerShell
Click any technique to open the MITRE ATT&CK reference.
Attack Timeline
- 2014Korea Hydro & Nuclear Power (KHNP) leaks attributed
- 2020-10CISA advisory AA20-301A on Kimsuky
- 2023-06US Treasury sanctions Kimsuky infrastructure
References
End of dossier · Kimsuky
Back to ThreatBox