Kimsuky

Kimsuky (also known as Velvet Chollima, Black Banshee, THALLIUM, Emerald Sleet, or APT43) is a North Korean state-backed hacker group and advanced persistent threat that targets South Korean think tanks, industry, nuclear power operators, and the South Korean Ministry of Unification for espionage purposes. In recent years Kimsuky has expanded its operations to target states such as Russia, the United States, and European nations.

History

According to the U.S. Cybersecurity and Infrastructure Security Agency Kimsuky has likely been active since 2012.

In March 2015 it was reported that South Korea claimed Kimsuky stole data from Korea Hydro & Nuclear Power.

In August 2019 it was reported that Kimsuky was targeting retired South Korean diplomats, government, and military officials, in an attack called "the first of its kind."

In September 2020 it was reported that Kimsuky attempted to hack 11 officials of the United Nations Security Council.

A lawmaker from the People Power Party reported that, in May 2021, Kimsuky was detected within the internal networks of the Korea Atomic Energy Research Institute.

On 30 November 2023 the Office of Foreign Assets Control of the U.S. Department of the Treasury sanctioned Kimsuky for gathering intelligence in support of North Korea's strategic objectives.

In June 2023 the FBI, the NSA and the US State Department issued a joint advisory with South Korea's National Intelligence Service, National Police Agency and Ministry of Foreign Affairs. It warned that Kimsuky impersonated journalists and academics in spear-phishing emails to collect intelligence from think tanks, research centers, universities and media outlets.

In a joint advisory reported in May 2024, the FBI, the NSA and the State Department warned that Kimsuky was exploiting improperly configured DMARC email policies to make its spear-phishing messages appear to come from legitimate domains.

See also

References

  1. ↑ "How Microsoft names threat actors". Microsoft. Retrieved 21 January 2024.
  2. ↑ "APT43: North Korean Group Uses Cybercrime to Fund Espionage Operations" (PDF). Mandiant. Retrieved 7 September 2025.
  3. ↑ "APT43". Fraunhofer FKIE. Retrieved 7 September 2025.
  4. ↑ Nocturnus, Cybereason. "Back to the Future: Inside the Kimsuky KGH Spyware Suite". www.cybereason.com. Retrieved 2021-03-15.
  5. ↑ "North Korean Advanced Persistent Threat Focus: Kimsuky | CISA". us-cert.cisa.gov. Retrieved 2021-03-15.
  6. 1 2 Cimpanu, Catalin. "North Korea has tried to hack 11 officials of the UN Security Council". ZDNet. Retrieved 2021-03-15.
  7. ↑ Cimpanu, Catalin. "North Korean state hackers target retired diplomats and military officials". ZDNet. Retrieved 2021-03-15.
  8. ↑ Onchi, Yosuke (June 18, 2021). "North Korean hack targets South's nuclear power research". Nikkei Asian Review.{{cite news}}: CS1 maint: deprecated archival service (link)
  9. ↑ "Treasury Targets DPRK's International Agents and Illicit Cyber Intrusion Group". U.S. Department of the Treasury. 30 November 2023. Retrieved 31 October 2026.
  10. ↑ Toulas, Bill (2 June 2023). "NSA and FBI: Kimsuky hackers pose as journalists to steal intel". BleepingComputer. Retrieved 31 October 2026.
  11. ↑ Greig, Jonathan (3 May 2024). "Email security loopholes are latest path for North Korean social engineering attacks". The Record by Recorded Future News. Retrieved 31 October 2026.