← All threat actors
KimsukyG0094 ↗
This threat actor targets South Korean think tanks, industry, nuclear power operators, and the Ministry of Unification for espionage purposes.
Motivation
Espionage
Suspected origin
Korea, Democratic People's Republic Of
Reports / IOCs (VT)
395 reports · 3,626 IOCs
Reported activity
2013 – 2026
Targeted industries
GovernmentOther
Targeted regions
Germany
Associated malware (17)
AlphaSeedAppleseedBabySharkFastFireFastSpyFlowerPowerGREASEGomirKimsukyMECHANICALNavRATNikiHTTPNikiTeaRRandomQueryTroll StealerUnidentified PS 004 (RAT)YoreKey
ATT&CK techniques in reports
- T1041 Exfiltration Over C2 Channel9
- T1566 Phishing9
- T1059.001 PowerShell8
- T1071.001 Web Protocols8
- T1082 System Information Discovery8
- T1027 Obfuscated Files or Information7
- T1083 File and Directory Discovery7
- T1204.002 Malicious File7
- T1566.001 Spearphishing Attachment7
- T1059 Command and Scripting Interpreter6
- T1059.005 Visual Basic6
- T1105 Ingress Tool Transfer6
- T1140 Deobfuscate/Decode Files or Information6
- T1056.003 Web Portal Capture5
- T1005 Data from Local System5
- T1053.005 Scheduled Task5
- T1059.003 Windows Command Shell5
- T1070.004 File Deletion5
- T1190 Exploit Public-Facing Application5
- T1566.002 Spearphishing Link5
Also known as
Sparkling Pisces, APT43, Thallium, Springtail, Black Banshee, Velvet Chollima, G0086, Operation Stolen Pencil, Emerald Sleet, THALLIUM