Loading threat actor…
Kimsuky is a North Korea-aligned espionage threat actor assessed to have operated on behalf of the North Korean government since at least 2012. The group is widely tracked under numerous aliases including NICKEL KIMBALL, THALLIUM, Emerald Sleet, Opal Sleet, APT43, TA406, TA427, Velvet Chollima, Black Banshee, ITG16, ARCHIPELAGO, UAT-5394, Sparking Pisces, Springtail, Larva-24005, SharpTongue, and Crooked Pisces. Its operations are primarily intelligence-driven and focus on collecting information relevant to North Korean policy, foreign relations, and regime interests. The actor primarily targets non-governmental organizations, think tanks, diplomatic agencies, military organizations, economic groups, and research entities, especially organizations and individuals involved in North Korean policy and relations. It initially focused on South Korean organizations and later expanded to similar targets in other countries. Reported objectives include gaining access to online accounts and organizational networks and tracking North Korean defectors and their relatives. Kimsuky is known for sustained spearphishing and highly tailored social engineering. It commonly develops customized lures based on research from social media and other public sources and has used typosquatting and target-themed infrastructure to improve credibility. Delivery methods have included malicious Hangul Word Processing documents in South Korea-focused campaigns, later broadening to Microsoft Word and PDF lures as targeting expanded internationally. Malware and tooling associated with this activity include Kimsuky RAT, KimJongRAT, KONNI, BabyShark, FastFire, FireViewer, FastSpy, and ReconShark. Its tooling and tradecraft are often described as distinct within the broader North Korean intrusion ecosystem.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
3 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
8 malware families attributed to this actor across reporting.
3 additional families tracked in Mallory.
1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.