Kimsuky
Kimsuky is a North Korean-based threat group that has been active since at least September 2013. The group focuses on targeting Korean think tank as well as DPRK/nuclear-related targets. The group was attributed as the actor behind the Korea Hydro & Nuclear Power Co. compromise.[1][2]
Associated Group Descriptions
| Name | Description |
|---|---|
| Velvet Chollima | [3] |
Techniques Used
| Domain | ID | Name | Use |
|---|---|---|---|
| Enterprise | T1176 | Browser Extensions |
Kimsuky has used a Google Chrome extension to infect victims and steal passwords and cookies from their browsers.[3] |
| Enterprise | T1042 | Change Default File Association |
Kimsuky has a HWP document stealer module which changes the default program association in the registry to open HWP documents.[4] |
| Enterprise | T1081 | Credentials in Files |
Kimsuky has used a Google Chrome extension to steal passwords and cookies from their browsers.[3] |
| Enterprise | T1022 | Data Encrypted | |
| Enterprise | T1005 | Data from Local System |
Kimsuky has collected Office, PDF, and HWP documents from its victims.[4] |
| Enterprise | T1089 | Disabling Security Tools |
Kimsuky has been observed disabling the system firewall and turning off Windows Security Center.[4] |
| Enterprise | T1041 | Exfiltration Over Command and Control Channel | |
| Enterprise | T1083 | File and Directory Discovery |
Kimsuky has the ability to enumerate all the drives on an infected system.[4] |
| Enterprise | T1107 | File Deletion |
Kimsuky has deleted the exfiltrated data on disk after transmission.[4] |
| Enterprise | T1056 | Input Capture | |
| Enterprise | T1170 | Mshta |
Kimsuky has used mshta to run malicious scripts on the system.[1] |
| Enterprise | T1050 | New Service | |
| Enterprise | T1086 | PowerShell | |
| Enterprise | T1055 | Process Injection |
Kimsuky has used Win7Elevate to inject malicious code into explorer.exe.[4] |
| Enterprise | T1060 | Registry Run Keys / Startup Folder |
Kimsuky has placed scripts in the startup folder for persistence.[4] |
| Enterprise | T1219 | Remote Access Tools |
Kimsuky has used a modified TeamViewer client as a command and control channel.[4] |
| Enterprise | T1193 | Spearphishing Attachment |
Kimsuky has used emails containing Word, Excel and/or HWP (Hangul Word Processor) documents in their spearphishing campaigns.[3][4] |
| Enterprise | T1192 | Spearphishing Link |
Kimsuky has used an email containing a link to a document that contained malicious macros.[1] |
| Enterprise | T1082 | System Information Discovery |
Kimsuky has gathered information about the infected computer.[4] |