Actors/Nation-state / APT/Asia

APT43

G0094APTKP · North Korea

AKA Kimsuky · Emerald Sleet · Sparkling Pisces · Springtail · Black Banshee · Archipelago · ITG16 · KTA082

Microsoft: ThalliumCrowdStrike: Velvet ChollimaMITRE: G0094Proofpoint: TA427Secureworks: IRON TILDEN

Targets22

Sectors17

Threat types1

GIRs covered0/480

Active since2012

Also tracked as

6 vendor names · 8 other aliases

Open Rosetta Stone

CrowdStrike

Velvet Chollima

Mandiant

APT43

Microsoft

Thallium

MITRE

G0094

Proofpoint

TA427

Secureworks

IRON TILDEN

UNATTRIBUTED ALIASESKimsukyEmerald SleetSparkling PiscesSpringtailBlack BansheeArchipelagoITG16KTA082

Victimology

Geographic footprint · 22 countries

origin · North Koreatargeted countries · 22

OCEANIA · 1

Australia

EUROPE · 10

Belgium · Switzerland · Germany · France · United Kingdom · Netherlands · Norway · Russia · Sweden · Slovakia

ASIA · 7

China · Indonesia · India · Japan · South Korea · Singapore · Thailand

AFRICA · 2

Egypt · South Africa

AMERICAS · 2

Cayman Islands · United States

Sectors targeted

17 of 40

Government100 actors Defense72 actors Aerospace59 actors Financial Services74 actors Cryptocurrency21 actors Healthcare47 actors Pharmaceutical27 actors Technology60 actors Retail & Hospitality33 actors NGOs & Dissidents56 actors Energy / Utilities59 actors Oil and Gas21 actors Education & Research62 actors Manufacturing (man)50 actors Media & Journalism49 actors Consulting / Professional Services35 actors Private Sector (generic)29 actors

Tactics, techniques, procedures

Threat types + MITRE ATT&CK mapping

THREAT TYPES

ESP · Espionage

MITRE ATT&CK · 96 techniques

Reconnaissance · 8

T1589.002Email Addresses T1589.003Employee Names T1591Gather Victim Org Information T1593.001Social Media T1594Search Victim-Owned Websites T1596Search Open Technical Databases T1598Phishing for Information T1682Query Public AI Services

Resource Development · 5

T1583Acquire Infrastructure T1583.004Server

Initial Access · 4

T1190Exploit Public-Facing Application

Execution · 9

T1053.005Scheduled Task

Persistence · 3

Credential Access · 7

T1003.001LSASS Memory

Discovery · 9

T1007System Service Discovery T1012Query Registry

Lateral Movement · 3

T1021.001Remote Desktop Protocol T1534Internal Spearphishing

Collection · 8

T1005Data from Local System T1113Screen Capture T1114.002Remote Email Collection

Exfiltration · 3

T1020Automated Exfiltration T1041Exfiltration Over C2 Channel T1567.002Exfiltration to Cloud Storage

Impact · 2

T1489Service Stop

Command And Control · 8

T1071.001Web Protocols T1071.002File Transfer Protocols T1071.003Mail Protocols

Defense Impairment · 3

T1112Modify Registry

Stealth · 24

T1027Obfuscated Files or Information

GIR coverage

0 / 480 requirements satisfied

Open matrix

No GIRs mapped yet for this actor.

Open data

Machine-readable exports of this profile

JSON · RESTActor recordFull profile via the public v1 API STIX 2.1Intrusion-set bundleDeterministic ids · techniques + targeted countries ATT&CK NAVIGATORTechnique layer96 techniques · layer format 4.5

Related actors

By origin and actor type

T1583.006

Web Services

T1585Establish Accounts

T1587Develop Capabilities

T1566

Phishing

T1566.001Spearphishing Attachment

T1566.002Spearphishing Link

T1059.001

PowerShell

T1059.003Windows Command Shell

T1059.005Visual Basic

T1059.006Python

T1059.007JavaScript

T1106Native API

T1204.001Malicious Link

T1204.004Malicious Copy and Paste

T1176.001

Browser Extensions

T1543.003Windows Service

T1547.001Registry Run Keys / Startup Folder

T1040

Network Sniffing

T1111Multi-Factor Authentication Interception

T1552.001Credentials In Files

T1552.004Private Keys

T1555.003Credentials from Web Browsers

T1557Adversary-in-the-Middle

T1016

System Network Configuration Discovery

T1033System Owner/User Discovery

T1057Process Discovery

T1083File and Directory Discovery

T1124System Time Discovery

T1217Browser Information Discovery

T1680Local Storage Discovery

T1550.002

Pass the Hash

T1114.003

Email Forwarding Rule

T1115Clipboard Data

T1185Browser Session Hijacking

T1560.001Archive via Utility

T1560.003Archive via Custom Method

T1657

Financial Theft

T1102.001

Dead Drop Resolver

T1102.002Bidirectional Communication

T1105Ingress Tool Transfer

T1219.002Remote Desktop Software

T1568Dynamic Resolution

T1685

Disable or Modify Tools

T1686Disable or Modify System Firewall

T1027.002

Software Packing

T1027.007Dynamic API Resolution

T1027.010Command Obfuscation

T1027.015Compression

T1036.004Masquerade Task or Service

T1036.005Match Legitimate Resource Name or Location

T1036.007Double File Extension

T1055Process Injection

T1055.001Dynamic-link Library Injection

T1055.012Process Hollowing

T1070.004File Deletion

T1078.003Local Accounts

T1140Deobfuscate/Decode Files or Information

T1205Traffic Signaling

T1218.005Mshta

T1218.010Regsvr32

T1218.011Rundll32

T1564.002Hidden Users

T1564.003Hidden Window

T1564.011Ignore Process Interrupts

T1620Reflective Code Loading

T1678Delay Execution

T1684.001Impersonation