Kimsuky

πŸ”΄ High
Also known as: APT43, Black Banshee, Earth Kumiho, Emerald Sleet, G0086, Greendinosa, Kimsuky, Kimsuky - APT-C-55, Operation Stolen Pencil, PatheticSlug, RGB-D5, Sparkling Pisces, Springtail, TA427, THALLIUM, Thallium, Velvet Chollima

Kimsuky is a North Korea-based cyber espionage group that has been active since at least 2012. The group initially targeted South Korean government agencies, think tanks, and subject-matter experts in various fields. Its operations expanded to include the United Nations and organizations in the government, education, business services, and manufacturing sectors across the United States, Japan, Russia, and Europe. Kimsuky has focused collection on foreign policy and national security issues tied to the Korean Peninsula, nuclear policy, and sanctions. Its operations have overlapped with other DPRK actors, likely due to ad hoc collaboration or limited resource sharing. EST Kimsuky April 2019 Cybereason Kimsuky November 2020 Malwarebytes Kimsuky June 2021 CISA AA20-301A Kimsuky Mandiant APT43 March 2024 Proofpoint TA427 April 2024 Because of overlapping operations, some researchers group a wide range of North Korean state-sponsored cyber activity under the broader Lazarus Group umbrella rather than tracking separate subgroup or cluster distinctions.

Kimsuky was assessed to be responsible for the 2014 Korea Hydro & Nuclear Power Co. compromise; other notable campaigns include Operation STOLEN PENCIL (2018), Operation Kabar Cobra (2019), and Operation Smoke Screen (2019). Netscout Stolen Pencil Dec 2018 EST Kimsuky SmokeScreen April 2019 AhnLab Kimsuky Kabar Cobra Feb 2019

In 2023, Kimsuky was observed using commercial large language models to assist with vulnerability research, scripting, social engineering and reconnaissance. MSFT-AI

🌍 Country North Korea
πŸ“… Activity 2021 β€” 2022
⚑ Risk Level High
🎯 Incident Type Espionage
🧭 ATT&CK G0094
Research - Innovation Energy Defense Diplomacy Academia - University News - Media Government Private sector
2021
2022

Targeted Victims

Ministry of Unification Sejong Institute Korea Institute for Defense Analyses Germany

Introduction

Kimsuky is a North Korea-based cyber espionage group that has been active since at least 2012. The group initially targeted South Korean government agencies, think tanks, and subject-matter experts in various fields. Its operations expanded to include the United Nations and organizations in the government, education, business services, and manufacturing sectors across the United States, Japan, Russia, and Europe. Kimsuky has focused collection on foreign policy and national security issues tied to the Korean Peninsula, nuclear policy, and sanctions. Its operations have overlapped with other DPRK actors, likely due to ad hoc collaboration or limited resource sharing. EST Kimsuky April 2019 Cybereason Kimsuky November 2020 Malwarebytes Kimsuky June 2021 CISA AA20-301A Kimsuky Mandiant APT43 March 2024 Proofpoint TA427 April 2024 Because of overlapping operations, some researchers group a wide range of North Korean state-sponsored cyber activity under the broader Lazarus Group umbrella rather than tracking separate subgroup or cluster distinctions. Kimsuky was assessed to be responsible for the 2014 Korea Hydro & Nuclear Power Co. compromise; other notable campaigns include Operation STOLEN PENCIL (2018), Operation Kabar Cobra (2019), and Operation Smoke Screen (2019). Netscout Stolen Pencil Dec 2018 EST Kimsuky SmokeScreen April 2019 AhnLab Kimsuky Kabar Cobra Feb 2019 In 2023, Kimsuky was observed using commercial large language models to assist with vulnerability research, scripting, social engineering and reconnaissance. MSFT-AI

Activities and Tactics

Targeted Sectors: Research - Innovation, Energy, Defense, Diplomacy, Academia - University, News - Media, Government, Private sector

Country of Origin: πŸ‡°πŸ‡΅ North Korea

Risk Level: High

First Seen: 2021

Last Activity: 2022

Incident Type: Espionage

Suspected Victims: Ministry of Unification, Sejong Institute, Korea Institute for Defense Analyses, Germany

Notable Campaigns

Information pending cataloguing.

Tactics, Techniques, and Procedures (TTPs)

ATT&CK technique IDs (denormalized)

Notable Indicators of Compromise (IOCs)

No atomic indicators are listed in this profile. The APTnotes snapshot indexes 2 public reports that may contain IOCs; see Source Attribution for dataset links.

Malware and Tools

  • PowerDuke
  • POWERSTATS
  • Power Loader
  • POWERSOURCE
  • Nuclear RAT
  • PowerRAT

MITRE ATT&CK Software

Attribution and Evidence

Country of Origin: North Korea Additional attribution information pending cataloguing.

References

[1] mitre-attack [2] Cloudflare 2026 Threat Report New Threat Actors March 2026 Cloudflare. (2026, March 3). Introducing the 2026 Cloudflare Threat Report. Retrieved April 18, 2026. [13] AhnLab Kimsuky Kabar Cobra Feb 2019 AhnLab. (2019, February 28). Operation Kabar Cobra - Tenacious cyber-espionage campaign by Kimsuky Group. Retrieved September 29, 2021. [14] EST Kimsuky April 2019 Alyac. (2019, April 3). Kimsuky Organization Steals Operation Stealth Power. Retrieved August 13, 2019. [15] Netscout Stolen Pencil Dec 2018 ASERT team. (2018, December 5). STOLEN PENCIL Campaign Targets Academia. Retrieved February 5, 2019. [16] Zdnet Kimsuky Dec 2018 Cimpanu, C.. (2018, December 5). Cyber-espionage group uses Chrome extension to infect victims. Retrieved August 26, 2019. [17] CISA AA20-301A Kimsuky CISA, FBI, CNMF. (2020, October 27). https://us-cert.cisa.gov/ncas/alerts/aa20-301a. Retrieved November 4, 2020. [18] Cybereason Kimsuky November 2020 Dahan, A. et al. (2020, November 2). Back to the Future: Inside the Kimsuky KGH Spyware Suite. Retrieved November 6, 2020. [19] EST Kimsuky SmokeScreen April 2019 ESTSecurity. (2019, April 17). Analysis of the APT Campaign β€˜Smoke Screen’ targeting to Korea and US 좜처: https://blog.alyac.co.kr/2243 [μ΄μŠ€νŠΈμ‹œνλ¦¬ν‹° μ•Œμ•½ λΈ”λ‘œκ·Έ]. Retrieved September 29, 2021. [20] Malwarebytes Kimsuky June 2021 Jazi, H. (2021, June 1). Kimsuky APT continues to target South Korean government using AppleSeed backdoor. Retrieved June 10, 2021. [21] Proofpoint TA427 April 2024 Lesnewich, G. et al. (2024, April 16). From Social Engineering to DMARC Abuse: TA427’s Art of Information Gathering. Retrieved May 3, 2024. [22] Mandiant APT43 March 2024 Mandiant. (2024, March 14). APT43: North Korean Group Uses Cybercrime to Fund Espionage Operations. Retrieved May 3, 2024. [23] Microsoft Threat Actor Naming July 2023 Microsoft . (2023, July 12). How Microsoft names threat actors. Retrieved November 17, 2023. [24] MSFT-AI Microsoft Threat Intelligence. (2024, February 14). Staying ahead of threat actors in the age of AI. Retrieved March 11, 2024. [25] Rapid7 Threat Landscape Actors March 2026 Rapid7. (2026, March 18). 2026 GLOBAL THREAT LANDSCAPE REPORT: Decoding the Accelerated Cyber Attack Cycle. Retrieved April 18, 2026. [26] Symantec Troll Stealer 2024 Symantec Threat Hunter Team. (2024, May 16). Springtail: New Linux Backdoor Added to Toolkit. Retrieved January 17, 2025. [27] Securelist Kimsuky Sept 2013 Tarakanov , D.. (2013, September 11). The β€œKimsuky” Operation: A North Korean APT?. Retrieved August 13, 2019. [28] ThreatConnect Kimsuky September 2020 ThreatConnect. (2020, September 28). Kimsuky Phishing Operations Putting In Work. Retrieved October 30, 2020.