Kimsuky is a North Korea-based cyber espionage group that has been active since at least 2012. The group initially focused on targeting South Korean government entities, think tanks, and individuals identified as experts in various fields, and expanded its operations to include the United States, Russia, Europe, and the UN. Kimsuky has focused its intelligence collection activities on foreign policy and national security issues related to the Korean peninsula, nuclear policy, and sanctions.[1][2][3][4][5]
Kimsuky was assessed to be responsible for the 2014 Korea Hydro & Nuclear Power Co. compromise; other notable campaigns include Operation STOLEN PENCIL (2018), Operation Kabar Cobra (2019), and Operation Smoke Screen (2019).[6][7][8]
North Korean group definitions are known to have significant overlap, and some security researchers report all North Korean state-sponsored cyber activity under the name Lazarus Group instead of tracking clusters or subgroups.
Name | Description |
---|---|
STOLEN PENCIL | |
Thallium | |
Black Banshee | |
Velvet Chollima |
Domain | ID | Name | Use | |
---|---|---|---|---|
Enterprise | T1098 | Account Manipulation |
Kimsuky has added accounts to specific groups with |
|
Enterprise | T1583 | .001 | Acquire Infrastructure: Domains |
Kimsuky has registered domains to spoof targeted organizations and trusted third parties.[10][12][5][3][4][11] |
.004 | Acquire Infrastructure: Server |
Kimsuky has purchased hosting servers with virtual currency and prepaid cards.[11] |
||
.006 | Acquire Infrastructure: Web Services |
Kimsuky has hosted content used for targeting efforts via web services such as Blogspot.[13] |
||
Enterprise | T1557 | Adversary-in-the-Middle |
Kimsuky has used modified versions of PHProxy to examine web traffic between the victim and the accessed website.[5] |
|
Enterprise | T1071 | .001 | Application Layer Protocol: Web Protocols | |
.002 | Application Layer Protocol: File Transfer Protocols |
Kimsuky has used FTP to download additional malware to the target machine.[14] |
||
.003 | Application Layer Protocol: Mail Protocols |
Kimsuky has used e-mail to send exfiltrated data to C2 servers.[5] |
||
Enterprise | T1560 | .001 | Archive Collected Data: Archive via Utility |
Kimsuky has used QuickZip to archive stolen files before exfiltration.[13] |
.003 | Archive Collected Data: Archive via Custom Method | |||
Enterprise | T1547 | .001 | Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder |
Kimsuky has placed scripts in the startup folder for persistence and modified the |
Enterprise | T1176 | Browser Extensions |
Kimsuky has used Google Chrome browser extensions to infect victims and to steal passwords and cookies.[9][6] |
|
Enterprise | T1059 | .001 | Command and Scripting Interpreter: PowerShell |
Kimsuky has executed a variety of PowerShell scripts.[1][5][13][11] |
.003 | Command and Scripting Interpreter: Windows Command Shell |
Kimsuky has executed Windows commands by using |
||
.005 | Command and Scripting Interpreter: Visual Basic |
Kimsuky has used Visual Basic to download malicious payloads.[10][14][16][13] Kimsuky has also used malicious VBA macros within maldocs disguised as forms that trigger when a victim types any content into the lure.[13] |
||
.006 | Command and Scripting Interpreter: Python |
Kimsuky has used a macOS Python implant to gather data as well as MailFetcher.py code to automatically collect email data.[5][11] |
||
.007 | Command and Scripting Interpreter: JavaScript |
Kimsuky has used JScript for logging and downloading additional tools.[14][5] |
||
Enterprise | T1586 | .002 | Compromise Accounts: Email Accounts |
Kimsuky has compromised email accounts to send spearphishing e-mails.[14][4] |
Enterprise | T1584 | .001 | Compromise Infrastructure: Domains |
Kimsuky has compromised legitimate sites and used them to distribute malware.[11] |
Enterprise | T1136 | .001 | Create Account: Local Account | |
Enterprise | T1543 | .003 | Create or Modify System Process: Windows Service | |
Enterprise | T1555 | .003 | Credentials from Password Stores: Credentials from Web Browsers |
Kimsuky has used browser extensions including Google Chrome to steal passwords and cookies from browsers. Kimsuky has also used Nirsoft's WebBrowserPassView tool to dump the passwords obtained from victims.[9][5][6][13] |
Enterprise | T1005 | Data from Local System |
Kimsuky has collected Office, PDF, and HWP documents from its victims.[15][13] |
|
Enterprise | T1074 | .001 | Data Staged: Local Data Staging |
Kimsuky has staged collected data files under |
Enterprise | T1140 | Deobfuscate/Decode Files or Information | ||
Enterprise | T1587 | Develop Capabilities |
Kimsuky created and used a mailing toolkit to use in spearphishing attacks.[14] |
|
.001 | Malware |
Kimsuky has developed its own unique malware such as MailFetch.py for use in operations.[11][13] |
||
Enterprise | T1114 | .002 | Email Collection: Remote Email Collection |
Kimsuky has used tools such as the MailFetch mail crawler to collect victim emails (excluding spam) from online services via IMAP.[11] |
.003 | Email Collection: Email Forwarding Rule |
Kimsuky has set auto-forward rules on victim's e-mail accounts.[5] |
||
Enterprise | T1585 | .001 | Establish Accounts: Social Media Accounts |
Kimsuky has created social media accounts to monitor news and security trends as well as potential targets.[11] |
.002 | Establish Accounts: Email Accounts |
Kimsuky has created email accounts for phishing operations.[11] |
||
Enterprise | T1546 | .001 | Event Triggered Execution: Change Default File Association |
Kimsuky has a HWP document stealer module which changes the default program association in the registry to open HWP documents.[15] |
Enterprise | T1041 | Exfiltration Over C2 Channel | ||
Enterprise | T1567 | .002 | Exfiltration Over Web Service: Exfiltration to Cloud Storage |
Kimsuky has exfiltrated stolen files and data to actor-controlled Blogspot accounts.[13] |
Enterprise | T1190 | Exploit Public-Facing Application |
Kimsuky has exploited various vulnerabilities for initial access, including Microsoft Exchange vulnerability CVE-2020-0688.[11] |
|
Enterprise | T1133 | External Remote Services | ||
Enterprise | T1083 | File and Directory Discovery |
Kimsuky has the ability to enumerate all files and directories on an infected system.[15][13][11] |
|
Enterprise | T1589 | .002 | Gather Victim Identity Information: Email Addresses |
Kimsuky has collected valid email addresses that were subsequently used in spearphishing campaigns.[4] |
.003 | Gather Victim Identity Information: Employee Names | |||
Enterprise | T1591 | Gather Victim Org Information |
Kimsuky has collected victim organization information including but not limited to organization hierarchy, functions, press releases, and others.[11] |
|
Enterprise | T1564 | .002 | Hide Artifacts: Hidden Users |
Kimsuky has run |
.003 | Hide Artifacts: Hidden Window |
Kimsuky has used an information gathering module that will hide an AV software window from the victim.[13] |
||
Enterprise | T1562 | .001 | Impair Defenses: Disable or Modify Tools |
Kimsuky has been observed turning off Windows Security Center and can hide the AV software window from the view of the infected user.[15][13] |
.004 | Impair Defenses: Disable or Modify System Firewall |
Kimsuky has been observed disabling the system firewall.[15] |
||
Enterprise | T1070 | .004 | Indicator Removal on Host: File Deletion |
Kimsuky has deleted the exfiltrated data on disk after transmission. Kimsuky has also used an instrumentor script to terminate browser processes running on an infected system and then delete the cookie files on disk.[15][13][11] |
.006 | Indicator Removal on Host: Timestomp |
Kimsuky has manipulated timestamps for creation or compilation dates to defeat anti-forensics.[3] |
||
Enterprise | T1105 | Ingress Tool Transfer |
Kimsuky has downloaded additional scripts, tools, and malware onto victim systems.[16][13] |
|
Enterprise | T1056 | .001 | Input Capture: Keylogging |
Kimsuky has used a PowerShell-based keylogger as well as a tool called MECHANICAL to log keystrokes.[1][15][5][6][13][11] |
Enterprise | T1534 | Internal Spearphishing |
Kimsuky has sent internal spearphishing emails for lateral movement after stealing victim information.[11] |
|
Enterprise | T1036 | Masquerading |
Kimsuky has disguised its C2 addresses as the websites of shopping malls, governments, universities, and others.[11] |
|
.004 | Masquerade Task or Service |
Kimsuky has disguised services to appear as benign software or related to operating system functions.[5] |
||
.005 | Match Legitimate Name or Location |
Kimsuky has renamed malware to legitimate names such as |
||
Enterprise | T1112 | Modify Registry |
Kimsuky has modified Registry settings for default file associations to enable all macros and for persistence.[5][16][13][11] |
|
Enterprise | T1111 | Multi-Factor Authentication Interception |
Kimsuky has used a proprietary tool to intercept one time passwords required for two-factor authentication.[11] |
|
Enterprise | T1040 | Network Sniffing |
Kimsuky has used the Nirsoft SniffPass network sniffer to obtain passwords sent over non-secure protocols.[5][6] |
|
Enterprise | T1027 | Obfuscated Files or Information |
Kimsuky has obfuscated binary strings including the use of XOR encryption and Base64 encoding.[10][14] Kimsuky has also modified the first byte of DLL implants targeting victims to prevent recognition of the executable file format.[13] |
|
.002 | Software Packing | |||
Enterprise | T1588 | .002 | Obtain Capabilities: Tool |
Kimsuky has obtained and used tools such as Nirsoft WebBrowserPassVIew, Mimikatz, and PsExec.[6][13] |
.005 | Obtain Capabilities: Exploits | |||
Enterprise | T1003 | .001 | OS Credential Dumping: LSASS Memory |
Kimsuky has gathered credentials using Mimikatz and ProcDump.[5][6][11] |
Enterprise | T1566 | .001 | Phishing: Spearphishing Attachment |
Kimsuky has used emails containing Word, Excel and/or HWP (Hangul Word Processor) documents in their spearphishing campaigns.[9][15][10][14][3][4][13][11] |
.002 | Phishing: Spearphishing Link |
Kimsuky has sent spearphishing emails containing a link to a document that contained malicious macros or took the victim to an actor-controlled domain.[1][6][11] |
||
Enterprise | T1598 | .003 | Phishing for Information: Spearphishing Link |
Kimsuky has used links in e-mail to steal account information.[14][4][11] |
Enterprise | T1057 | Process Discovery |
Kimsuky can gather a list of all processes running on a victim's machine.[13] |
|
Enterprise | T1055 | Process Injection |
Kimsuky has used Win7Elevate to inject malicious code into explorer.exe.[15] |
|
.012 | Process Hollowing |
Kimsuky has used a file injector DLL to spawn a benign process on the victim's system and inject the malicious payload into it via process hollowing.[13] |
||
Enterprise | T1012 | Query Registry |
Kimsuky has obtained specific Registry keys and values on a compromised host.[13] |
|
Enterprise | T1219 | Remote Access Software |
Kimsuky has used a modified TeamViewer client as a command and control channel.[15][16] |
|
Enterprise | T1021 | .001 | Remote Services: Remote Desktop Protocol |
Kimsuky has used RDP for direct remote point-and-click access.[6] |
Enterprise | T1053 | .005 | Scheduled Task/Job: Scheduled Task |
Kimsuky has downloaded additional malware with scheduled tasks.[11] |
Enterprise | T1593 | .001 | Search Open Websites/Domains: Social Media |
Kimsuky has used Twitter to monitor potential victims and to prepare targeted phishing e-mails.[4] |
.002 | Search Open Websites/Domains: Search Engines |
Kimsuky has searched for vulnerabilities, tools, and geopolitical trends on Google to target victims.[11] |
||
Enterprise | T1594 | Search Victim-Owned Websites |
Kimsuky has searched for information on the target company's website.[11] |
|
Enterprise | T1505 | .003 | Server Software Component: Web Shell |
Kimsuky has used modified versions of open source PHP web shells to maintain access, often adding "Dinosaur" references within the code.[5] |
Enterprise | T1518 | .001 | Software Discovery: Security Software Discovery |
Kimsuky has checked for the presence of antivirus software with |
Enterprise | T1608 | .001 | Stage Capabilities: Upload Malware |
Kimsuky has used Blogspot to host malicious content such as beacons, file exfiltrators, and implants.[13] |
Enterprise | T1553 | .002 | Subvert Trust Controls: Code Signing | |
Enterprise | T1218 | .005 | System Binary Proxy Execution: Mshta |
Kimsuky has used mshta.exe to run malicious scripts on the system.[1][5][16][11] |
.010 | System Binary Proxy Execution: Regsvr32 | |||
.011 | System Binary Proxy Execution: Rundll32 |
Kimsuky has used |
||
Enterprise | T1082 | System Information Discovery |
Kimsuky has enumerated drives, OS type, OS version, and other information using a script or the "systeminfo" command.[15][13] |
|
Enterprise | T1016 | System Network Configuration Discovery |
Kimsuky has used |
|
Enterprise | T1007 | System Service Discovery |
Kimsuky has used an instrumentor script to gather the names of all services running on a victim's system.[13] |
|
Enterprise | T1552 | .001 | Unsecured Credentials: Credentials In Files |
Kimsuky has used tools that are capable of obtaining credentials from saved mail.[6] |
Enterprise | T1550 | .002 | Use Alternate Authentication Material: Pass the Hash |
Kimsuky has used pass the hash for authentication to remote access software used in C2.[5] |
Enterprise | T1204 | .001 | User Execution: Malicious Link |
Kimsuky has lured victims into clicking malicious links.[11] |
.002 | User Execution: Malicious File |
Kimsuky has used attempted to lure victims into opening malicious e-mail attachments.[10][14][5][3][4][13] |
||
Enterprise | T1078 | .003 | Valid Accounts: Local Accounts |
Kimsuky has used a tool called GREASE to add a Windows admin account in order to allow them continued access via RDP.[6] |
Enterprise | T1102 | .002 | Web Service: Bidirectional Communication |