Kimsuky
threat actorKP01
also known as
Other names and identifiers for this entity.
MISP
APT43 · Black Banshee · Emerald Sleet · Kimsuky · Operation Stolen Pencil · Sparkling Pisces · Springtail · Thallium · Velvet Chollima
This threat actor targets South Korean think tanks, industry, nuclear power operators, and the Ministry of Unification for espionage purposes.
02
related actors
Related entries.
- Opal Sleet· likely
- Ruby Sleet· likely
03
references
External citations — patches, advisories, analysis.
- https://securelist.com/the-kimsuky-operation-a-north-korean-apt/57915/
- https://www.cfr.org/interactive/cyber-operations/kimsuky
- https://www.pwc.co.uk/issues/cyber-security-data-privacy/research/tracking-kimsuky-north-korea-based-cyber-espionage-group-part-2.html
- https://youtu.be/hAsKp43AZmM?t=1027
- https://www.bloomberglaw.com/document/public/subdoc/X67FPNDOUBV9VOPS35A4864BFIU?imagename=1
- https://www.netscout.com/blog/asert/stolen-pencil-campaign-targets-academia
- https://unit42.paloaltonetworks.com/new-babyshark-malware-targets-u-s-national-security-think-tanks/
- https://attack.mitre.org/groups/G0086/