North KoreaAttributedRGBEspionageActive 2012 – 2026Kimsuky
Also known asVelvet Chollima · Emerald Sleet · THALLIUM · Springtail · Kimsuki · TA408 · TA427 · TAG-115 · CloudDragon · SharpTongue · Crooked Pisces · Black Banshee · APT43 · Archipelago · ITG16 · KTA082 · Sparkling Pisces · Larva-24005 · Larva-25004 · Earth Kumiho · PatheticSlug · NICKEL KIMBALL
Summary
DPRK Reconnaissance General Bureau cluster targeting government, academic, think-tank, and policy researchers on Korean Peninsula affairs (MITRE G0094). Microsoft tracks the cluster as Emerald Sleet. Long-running spearphishing operation against journalists, defectors, and former officials. 2024-2025: KimDogRAT (Talos), AppleSeed v3, BabyShark continued deployment. October 2024 Mandiant report documented Cloud Workstation abuse via Google Drive/Dropbox for staging. Heavy use of HWP (Hangul Word Processor) lures for ROK government targets and weaponised LNK files.
Attribution
Reconnaissance General Bureau
Named by a government: indictment, sanctions designation, joint advisory or official statement.
- US Treasury (OFAC) (Government, 2023-11-30)
Sanctions: subordinate to the Reconnaissance General Bureau - MITRE ATT&CK (MITRE ATT&CK, 2026-10)
DPRK-based cyber espionage group
Campaigns 4
| Campaign | Period | Targets | Sectors | Source |
|---|---|---|---|---|
| Operation GitPower — Ukrainian diplomacy/security experts (fake KCSCON 2026 invitation) | 2026-08 – 2026-09 | Ukraine, Japan | Government, Think Tanks, Civil Society | Genians Security Center (2026-10-11) |
| HttpSpy — fake security-software installer and spoofed Webex pages (JSONPing) | 2026-03 – 2026-04 | South Korea | Defense, Military, Corporate | ENKI WhiteHat (2026-05-27) |
| Operation GitPower — AI-generated decoys and local LLM tooling (GitHub PAT-based LNK chain)ASSESSED | 2026-03 – 2026-07 | South Korea, Diplomatic missions | Diplomacy, Military, Security, Virtual Assets | Genians Security Center (2026-08-10) |
| Quishing (malicious QR code) spearphishing — MFA bypass via session-token replay | 2025-05 – 2025-06 | USA | Think Tanks, Academia, Government, NGO, Strategic Advisory | FBI FLASH AC-000001-MW (2026-01-08) |
Newest first. ASSESSED: tied to the actor with hedging or through an alias. CLAIMED: an allegation no independent source confirms.
MITRE ATT&CK techniques 16
| Reconnaissance2 | T1598Phishing for InformationT1596Search Open Technical Databases |
|---|---|
| Initial Access2 | T1566.001Spearphishing AttachmentT1566.002Spearphishing Link |
| Execution2 | T1059.001PowerShellT1059.007JavaScript |
| Stealth2 | T1036.007Double File ExtensionT1480.002Mutual Exclusion |
| Credential Access1 | T1056.001Keylogging |
| Lateral Movement1 | T1550.004Web Session Cookie |
| Collection3 | T1560Archive Collected DataT1185Browser Session HijackingT1056.003Web Portal Capture |
| Command and Control3 | T1102.002Bidirectional CommunicationT1219.001IDE TunnelingT1132.002Non-Standard Encoding |
Malware and tools 15
| Name | Description | Platform |
|---|---|---|
| BabyShark | PowerShell RAT | Windows |
| AppleSeed | Backdoor | Windows |
| GoldDragon | Backdoor cluster | Windows |
| BabyShark v3 | Recon Script | Windows |
| KimDogRAT | Backdoor | Windows |
| TutorialRAT | RAT | Windows |
| HttpSpy | Backdoor (3-stage installer/loader chain) | Windows |
| HelloDoor | Backdoor (Rust, PebbleDash family) | Windows |
| httpMalice | Backdoor (PebbleDash family) | Windows |
| httpTroy | Backdoor (PebbleDash family) | Windows |
| HappyDoor | Backdoor (AppleSeed cluster) | Windows |
| Troll Stealer | Malware | Windows |
| GoBear | Malware | Windows |
| Gomir | Malware | Linux |
| TRANSLATEXT | Malware | Windows |
Exploited vulnerabilities 1
| CVE | CVSS | Detail |
|---|---|---|
| CVE-2020-0688 | 8.8 | Microsoft Exchange Server — fixed cryptographic key RCE (KEV 2021-11-03) |
Highest CVSS first.
Infrastructure patterns
- GitHub for commands and stolen data, GitLab for scripts, Codeberg for archives (Genians, 2026)
- One certificate reused across C&C, phishing and distribution servers; C&C in two recurring ASNs (Enki, 2026)
- Exfiltration by email from encrypting malware; a modified TeamViewer 5.0.9104 client for C2 (CISA, 2020)
Reporting and advisories 6
- CISA
AA20-301A — North Korean Kimsuky Overview - FBI FLASH AC-000001-MW
Quishing (malicious QR code) spearphishing — MFA bypass via session-token replay - ENKI WhiteHat
HttpSpy — fake security-software installer and spoofed Webex pages (JSONPing) - Genians Security Center
Operation GitPower — Ukrainian diplomacy/security experts (fake KCSCON 2026 invitation) - Genians Security Center
Operation GitPower — AI-generated decoys and local LLM tooling (GitHub PAT-based LNK chain) - MITRE ATT&CK
Kimsuky (G0094) group profile