Kimsuky

G0094KPEspionage1 report from 1 vendor· last reported 2026-05-14

This threat actor targets South Korean think tanks, industry, nuclear power operators, and the Ministry of Unification for espionage purposes.

Vendor aliases (12)

The same group is tracked under different names by different vendors.

Vendor	Name
Microsoft	Emerald Sleet
CrowdStrike	Velvet Chollima
OSINT	Black Banshee
OSINT	Thallium
OSINT	Operation Stolen Pencil
OSINT	G0086
OSINT	APT43
OSINT	Springtail
OSINT	Sparkling Pisces
OSINT	TA427
OSINT	Earth Kumiho
OSINT	PatheticSlug

Targeting

Sectors: Government, Private sector, Research - Innovation, Energy, Defense, Diplomacy, Academia - University , News - Media

Victim countries: Ministry of Unification, Sejong Institute, Korea Institute for Defense Analyses, Germany

MITRE ATT&CK techniques (133)

T1003.001 T1005 T1007 T1012 T1016 T1020 T1021.001 T1027 T1027.001 T1027.002 T1027.007 T1027.010 T1027.012 T1027.013 T1027.015 T1027.016 T1033 T1036.004 T1036.005 T1036.007 T1040 T1041 T1053.005 T1055 T1055.001 T1055.012 T1056.001 T1056.003 T1057 T1059.001 T1059.003 T1059.005 T1059.006 T1059.007 T1070.004 T1070.006 T1071.001 T1071.002 T1071.003 T1074.001 T1078.003 T1082 T1083 T1098.007 T1102.001 T1102.002 T1105 T1106 T1111 T1112 T1113 T1114.002 T1114.003 T1115 T1124 T1132.002 T1133 T1136.001 T1140 T1176.001 T1185 T1190 T1204.001 T1204.002 T1204.004 T1205 T1217 T1218 T1218.005 T1218.010 T1218.011 T1219.002 T1480.002 T1489 T1497.001 T1505.003 T1518.001 T1534 T1539 T1543.003 T1546.001 T1547.001 T1550.002 T1552.001 T1552.004 T1553.002 T1555.003 T1557 T1559.001 T1560.001 T1560.003 T1564.002 T1564.003 T1564.011 T1566 T1566.001 T1566.002 T1567.002 T1568 T1574.002 T1583 T1583.001 T1583.004 T1583.006 T1584.001 T1585 T1585.001 T1585.002 T1586.002 T1587 T1587.001 T1588.002 T1588.003 T1588.005 T1589.002 T1589.003 T1591 T1593.001 T1593.002 T1594 T1596 T1598 T1598.003 T1608.001 T1620 T1657 T1660 T1678 T1680 T1682 T1684.001 T1685 T1686

Indicators of compromise

hash995a0a49ae4b244928b3f67e2bfd7a6e

hash52f1ff082e981cbdfd1f045c6021c63f

hash65fc9f06de5603e2c1af9b4f288bb22c

hash8e15c4d4f71bdd9dbc48cd2cabc87806

hash8983ffa6da23e0b99ccc58c17b9788c7

domainC:\ProgramData

domainHKCU\Software\Microsoft\Windows\CurrentVersion\Run

domainfemale-disorder-beta-metropolitan.trycloudflare.com

domainC:\Windows\system32

domainC:\GPKI

domainvscode.download.prss.microsoft.com

domainC:\Users\Public

domaingithub.com

domainhttps://vscode.dev/tunnel/”

domainC:\programdata\unrar.exe

domainC:\programdata\1.zip

domainnode896147.dwservice.net

domainnode828765.dwservice.net

domainnode484265.dwservice.net

domainwww.dwservice.net

domainkaspersky.com

hash9fe43e08c8f446554340f972dac8a68c

hashc19aeaedbbfc4e029f7e9bdface495b9

hasha7f0a18ac87e982d6f32f7a715e12532

hashf4465403f9693939fe9c439f0ab33610

hash5c373c2116ab4a615e622f577e22e9be

hashd1ec20144c83bba921243e72c517da5e

hash58ac2f65e335922be3f60e57099dc8a3

hashf73ba062116ea9f37d072aa41c7f5108

hash7e0825019d0de0c1c4a1673f94043ddb

hash08160acf08fccecde7b34090db18b321

hash94faed9af49c98a89c8acc55e97276c9

hashc42ae004badddd3017adadbdd1421e00

hash9ca5f93a732f404bbb2cee848f5bbda0

hash678fb1a87af525c33ba2492552d5c0e2

domainload.auraria.org

domainnewjo-imd.com

Top 37 by how many reports mention them.

Report timeline

Every report in the Global Intel Library that names Kimsuky, newest first. Open any report to see the full analysis with provenance.

Kaspersky2026-05-14
Kimsuky targets organizations with PebbleDash-based tools
T1566.001T1071.001T1059.001T1218T1547.001T1567.002T1574.002T1053.005
original

Threat feed IOCs (9)

Indicators from free threat feeds (abuse.ch ThreatFox, AlienVault OTX) attributed to Kimsuky. Each row shows why it was linked and where it came from.

Type	Indicator	Linked by	Seen	Source
domain	ray-id-v3.com	malware family "Amadey"	2026-10-18	abuse.ch ThreatFox
url	http://109.238.87.75/g84kfS5n/index.php	malware family "Amadey"	2026-10-13	abuse.ch ThreatFox
ip:port	193.178.158.71:80	malware family "Amadey"	2026-10-09	abuse.ch ThreatFox
url	http://193.178.158.71/b894jfjw/index.php	malware family "Amadey"	2026-10-09	abuse.ch ThreatFox
ip:port	193.178.158.107:80	malware family "Amadey"	2026-09-21	abuse.ch ThreatFox
url	http://193.178.158.107/Bjsw3DlG1/index.php	malware family "Amadey"	2026-09-20	abuse.ch ThreatFox
ip:port	91.92.242.236:80	malware family "Amadey"	2026-04-26	abuse.ch ThreatFox
url	http://91.92.242.236/oPvjr94jfe/index.php	malware family "Amadey"	2026-04-26	abuse.ch ThreatFox
url	http://196.251.107.248/kont2rt/index.php	malware family "Amadey"	2026-04-23	abuse.ch ThreatFox

Public research & publications (34)

Open-source reports about this actor collected from MISP Galaxy and MITRE ATT&CK.

asert.arbornetworks.comhttps://asert.arbornetworks.com/stolen-pencil-campaign-targets-academia/
attack.mitre.orghttps://attack.mitre.org/groups/G0094
blog.alyac.co.krhttps://blog.alyac.co.kr/2234
blog.alyac.co.krhttps://blog.alyac.co.kr/attachment/cfile5.uf@99A0CD415CB67E210DCEB3.pdf
blog.cloudflare.comhttps://blog.cloudflare.com/2026-threat-report/
blog.malwarebytes.comhttps://blog.malwarebytes.com/threat-analysis/2021/06/kimsuky-apt-continues-to-target-south-korean-government-using-appleseed-backdoor/
global.ahnlab.comhttps://global.ahnlab.com/global/upload/download/techreport/%5BAnalysis_Report%5DOperation%20Kabar%20Cobra.pdf
learn.microsoft.comhttps://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide
securelist.comhttps://securelist.com/the-kimsuky-operation-a-north-korean-apt/57915/
services.google.comhttps://services.google.com/fh/files/misc/apt43-report-en.pdf
threatconnect.comhttps://threatconnect.com/blog/kimsuky-phishing-operations-putting-in-work/
us-cert.cisa.govhttps://us-cert.cisa.gov/ncas/alerts/aa20-301a
cybereason.comhttps://www.cybereason.com/blog/back-to-the-future-inside-the-kimsuky-kgh-spyware-suite
microsoft.comhttps://www.microsoft.com/en-us/security/blog/2024/02/14/staying-ahead-of-threat-actors-in-the-age-of-ai/
proofpoint.comhttps://www.proofpoint.com/us/blog/threat-insight/social-engineering-dmarc-abuse-ta427s-art-information-gathering
rapid7.comhttps://www.rapid7.com/cdn/assets/bltc1ddd6561ab54a26/69ba67de50ca691edcd3f5b7/rapid7-threat-landscape-report-2026.pdf
security.comhttps://www.security.com/threat-intelligence/springtail-kimsuky-backdoor-espionage
zdnet.comhttps://www.zdnet.com/article/cyber-espionage-group-uses-chrome-extension-to-infect-victims/
cfr.orghttps://www.cfr.org/interactive/cyber-operations/kimsuky
pwc.co.ukhttps://www.pwc.co.uk/issues/cyber-security-data-privacy/research/tracking-kimsuky-north-korea-based-cyber-espionage-group-part-2.html
youtu.behttps://youtu.be/hAsKp43AZmM?t=1027
bloomberglaw.comhttps://www.bloomberglaw.com/document/public/subdoc/X67FPNDOUBV9VOPS35A4864BFIU?imagename=1
netscout.comhttps://www.netscout.com/blog/asert/stolen-pencil-campaign-targets-academia
unit42.paloaltonetworks.comhttps://unit42.paloaltonetworks.com/new-babyshark-malware-targets-u-s-national-security-think-tanks/
attack.mitre.orghttps://attack.mitre.org/groups/G0086/
mandiant.widen.nethttps://mandiant.widen.net/s/zvmfw5fnjs/apt43-report
asec.ahnlab.comhttps://asec.ahnlab.com/en/57873/
asec.ahnlab.comhttps://asec.ahnlab.com/en/61082/
rewterz.comhttps://www.rewterz.com/rewterz-news/rewterz-threat-alert-north-korean-apt-kimsuky-aka-black-banshee-active-iocs-29/
sentinelone.comhttps://www.sentinelone.com/labs/a-glimpse-into-future-scarcruft-campaigns-attackers-gather-strategic-intelligence-and-target-cybersecurity-professionals/
bsi.bund.dehttps://www.bsi.bund.de/DE/Themen/Unternehmen-und-Organisationen/Cyber-Sicherheitslage/Analysen-und-Prognosen/Threat-Intelligence/Aktive_APT-Gruppen/aktive-apt-gruppen_node.html
ctoatncsc.substack.comhttps://ctoatncsc.substack.com/p/cto-at-ncsc-summary-week-ending-may-16b
symantec-enterprise-blogs.security.comhttps://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/springtail-kimsuky-backdoor-espionage
unit42.paloaltonetworks.comhttps://unit42.paloaltonetworks.com/kimsuky-new-keylogger-backdoor-variant/