Kimsuky

Kimsuky is a North Korea-based cyber espionage group that has been active since at least 2012. The group initially focused on targeting South Korean government entities, think tanks, and individuals identified as experts in various fields, and expanded its operations to include the United States, Russia, Europe, and the UN. Kimsuky has focused its intelligence collection activities on foreign policy and national security issues related to the Korean peninsula, nuclear policy, and sanctions.[1][2][3][4][5]

Kimsuky was assessed to be responsible for the 2014 Korea Hydro & Nuclear Power Co. compromise; other notable campaigns include Operation STOLEN PENCIL (2018), Operation Kabar Cobra (2019), and Operation Smoke Screen (2019).[6][7][8]

North Korean group definitions are known to have significant overlap, and some security researchers report all North Korean state-sponsored cyber activity under the name Lazarus Group instead of tracking clusters or subgroups.

ID: G0094
Associated Groups: STOLEN PENCIL, Thallium, Black Banshee, Velvet Chollima
Contributors: Taewoo Lee, KISA; Dongwook Kim, KISA
Version: 3.1
Created: 26 August 2019
Last Modified: 27 September 2023

Associated Group Descriptions

Name Description
STOLEN PENCIL

[6]

Thallium

[3][4]

Black Banshee

[3][4]

Velvet Chollima

[9][10][4]

Techniques Used

Domain ID Name Use
Enterprise T1098 Account Manipulation

Kimsuky has added accounts to specific groups with net localgroup.[11]

Enterprise T1583 .001 Acquire Infrastructure: Domains

Kimsuky has registered domains to spoof targeted organizations and trusted third parties.[10][12][5][3][4][11]

.004 Acquire Infrastructure: Server

Kimsuky has purchased hosting servers with virtual currency and prepaid cards.[11]

.006 Acquire Infrastructure: Web Services

Kimsuky has hosted content used for targeting efforts via web services such as Blogspot.[13]

Enterprise T1557 Adversary-in-the-Middle

Kimsuky has used modified versions of PHProxy to examine web traffic between the victim and the accessed website.[5]

Enterprise T1071 .001 Application Layer Protocol: Web Protocols

Kimsuky has used HTTP GET and POST requests for C2.[13]

.002 Application Layer Protocol: File Transfer Protocols

Kimsuky has used FTP to download additional malware to the target machine.[14]

.003 Application Layer Protocol: Mail Protocols

Kimsuky has used e-mail to send exfiltrated data to C2 servers.[5]

Enterprise T1560 .001 Archive Collected Data: Archive via Utility

Kimsuky has used QuickZip to archive stolen files before exfiltration.[13]

.003 Archive Collected Data: Archive via Custom Method

Kimsuky has used RC4 encryption before exfil.[15]

Enterprise T1547 .001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder

Kimsuky has placed scripts in the startup folder for persistence and modified the HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce Registry key.[15][5][16][13][11]

Enterprise T1176 Browser Extensions

Kimsuky has used Google Chrome browser extensions to infect victims and to steal passwords and cookies.[9][6]

Enterprise T1059 .001 Command and Scripting Interpreter: PowerShell

Kimsuky has executed a variety of PowerShell scripts.[1][5][13][11]

.003 Command and Scripting Interpreter: Windows Command Shell

Kimsuky has executed Windows commands by using cmd and running batch scripts.[13][11]

.005 Command and Scripting Interpreter: Visual Basic

Kimsuky has used Visual Basic to download malicious payloads.[10][14][16][13] Kimsuky has also used malicious VBA macros within maldocs disguised as forms that trigger when a victim types any content into the lure.[13]

.006 Command and Scripting Interpreter: Python

Kimsuky has used a macOS Python implant to gather data as well as MailFetcher.py code to automatically collect email data.[5][11]

.007 Command and Scripting Interpreter: JavaScript

Kimsuky has used JScript for logging and downloading additional tools.[14][5]

Enterprise T1586 .002 Compromise Accounts: Email Accounts

Kimsuky has compromised email accounts to send spearphishing e-mails.[14][4]

Enterprise T1584 .001 Compromise Infrastructure: Domains

Kimsuky has compromised legitimate sites and used them to distribute malware.[11]

Enterprise T1136 .001 Create Account: Local Account

Kimsuky has created accounts with net user.[11]

Enterprise T1543 .003 Create or Modify System Process: Windows Service

Kimsuky has created new services for persistence.[15][5]

Enterprise T1555 .003 Credentials from Password Stores: Credentials from Web Browsers

Kimsuky has used browser extensions including Google Chrome to steal passwords and cookies from browsers. Kimsuky has also used Nirsoft's WebBrowserPassView tool to dump the passwords obtained from victims.[9][5][6][13]

Enterprise T1005 Data from Local System

Kimsuky has collected Office, PDF, and HWP documents from its victims.[15][13]

Enterprise T1074 .001 Data Staged: Local Data Staging

Kimsuky has staged collected data files under C:\Program Files\Common Files\System\Ole DB\.[5][13]

Enterprise T1140 Deobfuscate/Decode Files or Information

Kimsuky has decoded malicious VBScripts using Base64.[13]

Enterprise T1587 Develop Capabilities

Kimsuky created and used a mailing toolkit to use in spearphishing attacks.[14]

.001 Malware

Kimsuky has developed its own unique malware such as MailFetch.py for use in operations.[11][13]

Enterprise T1114 .002 Email Collection: Remote Email Collection

Kimsuky has used tools such as the MailFetch mail crawler to collect victim emails (excluding spam) from online services via IMAP.[11]

.003 Email Collection: Email Forwarding Rule

Kimsuky has set auto-forward rules on victim's e-mail accounts.[5]

Enterprise T1585 .001 Establish Accounts: Social Media Accounts

Kimsuky has created social media accounts to monitor news and security trends as well as potential targets.[11]

.002 Establish Accounts: Email Accounts

Kimsuky has created email accounts for phishing operations.[11]

Enterprise T1546 .001 Event Triggered Execution: Change Default File Association

Kimsuky has a HWP document stealer module which changes the default program association in the registry to open HWP documents.[15]

Enterprise T1041 Exfiltration Over C2 Channel

Kimsuky has exfiltrated data over its C2 channel.[15][13]

Enterprise T1567 .002 Exfiltration Over Web Service: Exfiltration to Cloud Storage

Kimsuky has exfiltrated stolen files and data to actor-controlled Blogspot accounts.[13]

Enterprise T1190 Exploit Public-Facing Application

Kimsuky has exploited various vulnerabilities for initial access, including Microsoft Exchange vulnerability CVE-2020-0688.[11]

Enterprise T1133 External Remote Services

Kimsuky has used RDP to establish persistence.[5]

Enterprise T1083 File and Directory Discovery

Kimsuky has the ability to enumerate all files and directories on an infected system.[15][13][11]

Enterprise T1589 .002 Gather Victim Identity Information: Email Addresses

Kimsuky has collected valid email addresses that were subsequently used in spearphishing campaigns.[4]

.003 Gather Victim Identity Information: Employee Names

Kimsuky has collected victim employee name information.[11]

Enterprise T1591 Gather Victim Org Information

Kimsuky has collected victim organization information including but not limited to organization hierarchy, functions, press releases, and others.[11]

Enterprise T1564 .002 Hide Artifacts: Hidden Users

Kimsuky has run reg add ‘HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList’ /v to hide a newly created user.[11]

.003 Hide Artifacts: Hidden Window

Kimsuky has used an information gathering module that will hide an AV software window from the victim.[13]

Enterprise T1562 .001 Impair Defenses: Disable or Modify Tools

Kimsuky has been observed turning off Windows Security Center and can hide the AV software window from the view of the infected user.[15][13]

.004 Impair Defenses: Disable or Modify System Firewall

Kimsuky has been observed disabling the system firewall.[15]

Enterprise T1070 .004 Indicator Removal: File Deletion

Kimsuky has deleted the exfiltrated data on disk after transmission. Kimsuky has also used an instrumentor script to terminate browser processes running on an infected system and then delete the cookie files on disk.[15][13][11]

.006 Indicator Removal: Timestomp

Kimsuky has manipulated timestamps for creation or compilation dates to defeat anti-forensics.[3]

Enterprise T1105 Ingress Tool Transfer

Kimsuky has downloaded additional scripts, tools, and malware onto victim systems.[16][13]

Enterprise T1056 .001 Input Capture: Keylogging

Kimsuky has used a PowerShell-based keylogger as well as a tool called MECHANICAL to log keystrokes.[1][15][5][6][13][11]

Enterprise T1534 Internal Spearphishing

Kimsuky has sent internal spearphishing emails for lateral movement after stealing victim information.[11]

Enterprise T1036 Masquerading

Kimsuky has disguised its C2 addresses as the websites of shopping malls, governments, universities, and others.[11]

.004 Masquerade Task or Service

Kimsuky has disguised services to appear as benign software or related to operating system functions.[5]

.005 Match Legitimate Name or Location

Kimsuky has renamed malware to legitimate names such as ESTCommon.dll or patch.dll.[11]

Enterprise T1112 Modify Registry

Kimsuky has modified Registry settings for default file associations to enable all macros and for persistence.[5][16][13][11]

Enterprise T1111 Multi-Factor Authentication Interception

Kimsuky has used a proprietary tool to intercept one time passwords required for two-factor authentication.[11]

Enterprise T1040 Network Sniffing

Kimsuky has used the Nirsoft SniffPass network sniffer to obtain passwords sent over non-secure protocols.[5][6]

Enterprise T1027 Obfuscated Files or Information

Kimsuky has obfuscated binary strings including the use of XOR encryption and Base64 encoding.[10][14] Kimsuky has also modified the first byte of DLL implants targeting victims to prevent recognition of the executable file format.[13]

.002 Software Packing

Kimsuky has packed malware with UPX.[4]

Enterprise T1588 .002 Obtain Capabilities: Tool

Kimsuky has obtained and used tools such as Nirsoft WebBrowserPassVIew, Mimikatz, and PsExec.[6][13]

.005 Obtain Capabilities: Exploits

Kimsuky has obtained exploit code for various CVEs.[11]

Enterprise T1003 .001 OS Credential Dumping: LSASS Memory

Kimsuky has gathered credentials using Mimikatz and ProcDump.[5][6][11]

Enterprise T1566 .001 Phishing: Spearphishing Attachment

Kimsuky has used emails containing Word, Excel and/or HWP (Hangul Word Processor) documents in their spearphishing campaigns.[9][15][10][14][3][4][13][11]

.002 Phishing: Spearphishing Link

Kimsuky has sent spearphishing emails containing a link to a document that contained malicious macros or took the victim to an actor-controlled domain.[1][6][11]

Enterprise T1598 .003 Phishing for Information: Spearphishing Link

Kimsuky has used links in e-mail to steal account information.[14][4][11]

Enterprise T1057 Process Discovery

Kimsuky can gather a list of all processes running on a victim's machine.[13]

Enterprise T1055 Process Injection

Kimsuky has used Win7Elevate to inject malicious code into explorer.exe.[15]

.012 Process Hollowing

Kimsuky has used a file injector DLL to spawn a benign process on the victim's system and inject the malicious payload into it via process hollowing.[13]

Enterprise T1012 Query Registry

Kimsuky has obtained specific Registry keys and values on a compromised host.[13]

Enterprise T1219 Remote Access Software

Kimsuky has used a modified TeamViewer client as a command and control channel.[15][16]

Enterprise T1021 .001 Remote Services: Remote Desktop Protocol

Kimsuky has used RDP for direct remote point-and-click access.[6]

Enterprise T1053 .005 Scheduled Task/Job: Scheduled Task

Kimsuky has downloaded additional malware with scheduled tasks.[11]

Enterprise T1593 .001 Search Open Websites/Domains: Social Media

Kimsuky has used Twitter to monitor potential victims and to prepare targeted phishing e-mails.[4]

.002 Search Open Websites/Domains: Search Engines

Kimsuky has searched for vulnerabilities, tools, and geopolitical trends on Google to target victims.[11]

Enterprise T1594 Search Victim-Owned Websites

Kimsuky has searched for information on the target company's website.[11]

Enterprise T1505 .003 Server Software Component: Web Shell

Kimsuky has used modified versions of open source PHP web shells to maintain access, often adding "Dinosaur" references within the code.[5]

Enterprise T1518 .001 Software Discovery: Security Software Discovery

Kimsuky has checked for the presence of antivirus software with powershell Get-CimInstance -Namespace root/securityCenter2 – classname antivirusproduct.[11]

Enterprise T1608 .001 Stage Capabilities: Upload Malware

Kimsuky has used Blogspot to host malicious content such as beacons, file exfiltrators, and implants.[13]

Enterprise T1553 .002 Subvert Trust Controls: Code Signing

Kimsuky has signed files with the name EGIS CO,. Ltd..[10]

Enterprise T1218 .005 System Binary Proxy Execution: Mshta

Kimsuky has used mshta.exe to run malicious scripts on the system.[1][5][16][11]

.010 System Binary Proxy Execution: Regsvr32

Kimsuky has executed malware with regsvr32s.[11]

.011 System Binary Proxy Execution: Rundll32

Kimsuky has used rundll32.exe to execute malicious scripts and malware on a victim's network.[13]

Enterprise T1082 System Information Discovery

Kimsuky has enumerated drives, OS type, OS version, and other information using a script or the "systeminfo" command.[15][13]

Enterprise T1016 System Network Configuration Discovery

Kimsuky has used ipconfig/all to gather network configuration information.[13]

Enterprise T1007 System Service Discovery

Kimsuky has used an instrumentor script to gather the names of all services running on a victim's system.[13]

Enterprise T1552 .001 Unsecured Credentials: Credentials In Files

Kimsuky has used tools that are capable of obtaining credentials from saved mail.[6]

Enterprise T1550 .002 Use Alternate Authentication Material: Pass the Hash

Kimsuky has used pass the hash for authentication to remote access software used in C2.[5]

Enterprise T1204 .001 User Execution: Malicious Link

Kimsuky has lured victims into clicking malicious links.[11]

.002 User Execution: Malicious File

Kimsuky has used attempted to lure victims into opening malicious e-mail attachments.[10][14][5][3][4][13]

Enterprise T1078 .003 Valid Accounts: Local Accounts

Kimsuky has used a tool called GREASE to add a Windows admin account in order to allow them continued access via RDP.[6]

Enterprise T1102 .002 Web Service: Bidirectional Communication

Kimsuky has used Blogspot pages for C2.[13]

Software

ID Name References Techniques
S0622 AppleSeed [4][11] Access Token Manipulation, Application Layer Protocol: Web Protocols, Archive Collected Data, Archive Collected Data: Archive via Utility, Automated Collection, Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Command and Scripting Interpreter: JavaScript, Command and Scripting Interpreter: PowerShell, Data from Local System, Data from Removable Media, Data Staged: Local Data Staging, Data Transfer Size Limits, Deobfuscate/Decode Files or Information, Exfiltration Over C2 Channel, Exfiltration Over Web Service, Fallback Channels, File and Directory Discovery, Indicator Removal: File Deletion, Input Capture: Keylogging, Masquerading, Masquerading: Match Legitimate Name or Location, Native API, Obfuscated Files or Information: Software Packing, Obfuscated Files or Information, Phishing: Spearphishing Attachment, Process Discovery, Screen Capture, System Binary Proxy Execution: Regsvr32, System Information Discovery, System Network Configuration Discovery, System Time Discovery, User Execution: Malicious File
S0414 BabyShark [5][3][16] Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Command and Scripting Interpreter: Windows Command Shell, Data Encoding: Standard Encoding, Deobfuscate/Decode Files or Information, File and Directory Discovery, Indicator Removal: File Deletion, Ingress Tool Transfer, Input Capture: Keylogging, Process Discovery, Query Registry, Scheduled Task/Job: Scheduled Task, System Binary Proxy Execution: Mshta, System Information Discovery, System Network Configuration Discovery, System Owner/User Discovery
S0252 Brave Prince [13] Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 Protocol, File and Directory Discovery, Impair Defenses: Disable or Modify Tools, Process Discovery, Query Registry, System Information Discovery, System Network Configuration Discovery
S0527 CSPY Downloader [3] Abuse Elevation Control Mechanism: Bypass User Account Control, Application Layer Protocol: Web Protocols, Indicator Removal: File Deletion, Indicator Removal, Ingress Tool Transfer, Masquerading: Masquerade Task or Service, Modify Registry, Obfuscated Files or Information: Software Packing, Scheduled Task/Job: Scheduled Task, Subvert Trust Controls: Code Signing, User Execution: Malicious File, Virtualization/Sandbox Evasion: System Checks
S0249 Gold Dragon [13] Application Layer Protocol: Web Protocols, Archive Collected Data, Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Command and Scripting Interpreter: Windows Command Shell, Data Staged: Local Data Staging, File and Directory Discovery, Impair Defenses: Disable or Modify Tools, Indicator Removal: File Deletion, Ingress Tool Transfer, Process Discovery, Query Registry, Software Discovery: Security Software Discovery, System Information Discovery, System Owner/User Discovery
S0526 KGH_SPY [3] Application Layer Protocol: Web Protocols, Boot or Logon Initialization Scripts: Logon Script (Windows), Command and Scripting Interpreter: Windows Command Shell, Command and Scripting Interpreter: PowerShell, Credentials from Password Stores: Credentials from Web Browsers, Credentials from Password Stores: Windows Credential Manager, Credentials from Password Stores, Data from Local System, Data Staged: Local Data Staging, Deobfuscate/Decode Files or Information, Email Collection: Local Email Collection, Exfiltration Over C2 Channel, File and Directory Discovery, Ingress Tool Transfer, Input Capture: Keylogging, Masquerading: Match Legitimate Name or Location, Obfuscated Files or Information, Software Discovery, System Information Discovery, User Execution: Malicious File
S0002 Mimikatz [6][11] Access Token Manipulation: SID-History Injection, Account Manipulation, Boot or Logon Autostart Execution: Security Support Provider, Credentials from Password Stores, Credentials from Password Stores: Credentials from Web Browsers, Credentials from Password Stores: Windows Credential Manager, OS Credential Dumping: DCSync, OS Credential Dumping: Security Account Manager, OS Credential Dumping: LSASS Memory, OS Credential Dumping: LSA Secrets, Rogue Domain Controller, Steal or Forge Authentication Certificates, Steal or Forge Kerberos Tickets: Golden Ticket, Steal or Forge Kerberos Tickets: Silver Ticket, Unsecured Credentials: Private Keys, Use Alternate Authentication Material: Pass the Hash, Use Alternate Authentication Material: Pass the Ticket
S0353 NOKKI [16] Application Layer Protocol: Web Protocols, Application Layer Protocol: File Transfer Protocols, Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Data Staged: Local Data Staging, Deobfuscate/Decode Files or Information, Indicator Removal: File Deletion, Ingress Tool Transfer, Input Capture: Credential API Hooking, Masquerading: Match Legitimate Name or Location, Obfuscated Files or Information, System Binary Proxy Execution: Rundll32, System Information Discovery, System Network Configuration Discovery, System Owner/User Discovery, System Time Discovery
S0029 PsExec [6] Create Account: Domain Account, Create or Modify System Process: Windows Service, Lateral Tool Transfer, Remote Services: SMB/Windows Admin Shares, System Services: Service Execution
S0111 schtasks [3][11] Scheduled Task/Job: Scheduled Task

References