Overview 25,678 indicators
Kimsuky is a Democratic People's Republic of Korea (DPRK)-based cyber espionage group that has been active since at least 2012. The group initially targeted South Korean government agencies, think tanks, and subject-matter experts in various fields. Its operations expanded to include the United Nations and organizations in the government, education, business services, and manufacturing sectors across the United States, Japan, Russia, and Europe. Kimsuky has focused collection on foreign policy and national security issues tied to the Korean Peninsula, nuclear policy, and sanctions. Kimsuky operations have overlapped with those of other North Korean state-sponsored cyber espionage actors as a result of ad hoc collaborations or other limited resource sharing. Kimsuky was assessed to be responsible for the 2014 Korea Hydro & Nuclear Power Co. compromise; other notable campaigns include Operation STOLEN PENCIL (2018), Operation Kabar Cobra (2019), and Operation Smoke Screen (2019). In 2023, Kimsuky was observed using commercial large language models (LLMs) to assist with vulnerability research, scripting, social engineering and reconnaissance. DPRK threat actor cluster boundaries overlap in open source reporting, with some security researchers consolidating all attributed North Korean state-sponsored cyber activity under Lazarus Group, rather than tracking operationally distinct subgroups.
| domain | 25,131 | G0094-domain.txt |
| url | 344 | G0094.json |
| url_path | 109 | G0094.json |
| ipv4 | 94 | G0094.json |
Techniques 131 ATT&CK
Open in ATT&CK Navigator → or download the layer (131 techniques, layer 4.5)
- T1003.001 LSASS Memory
- T1005 Data from Local System
- T1007 System Service Discovery
- T1012 Query Registry
- T1016 System Network Configuration Discovery
- T1020 Automated Exfiltration
- T1021.001 Remote Desktop Protocol
- T1027 Obfuscated Files or Information
- T1027.001 Binary Padding
- T1027.002 Software Packing
- T1027.007 Dynamic API Resolution
- T1027.010 Command Obfuscation
- T1027.012 LNK Icon Smuggling
- T1027.013 Encrypted/Encoded File
- T1027.015 Compression
- T1027.016 Junk Code Insertion
- T1033 System Owner/User Discovery
- T1036.004 Masquerade Task or Service
- T1036.005 Match Legitimate Resource Name or Location
- T1036.007 Double File Extension
- T1040 Network Sniffing
- T1041 Exfiltration Over C2 Channel
- T1053.005 Scheduled Task
- T1055 Process Injection
- T1055.001 Dynamic-link Library Injection
- T1055.012 Process Hollowing
- T1056.001 Keylogging
- T1056.003 Web Portal Capture
- T1057 Process Discovery
- T1059.001 PowerShell
- T1059.003 Windows Command Shell
- T1059.005 Visual Basic
- T1059.006 Python
- T1059.007 JavaScript
- T1070.004 File Deletion
- T1070.006 Timestomp
- T1071.001 Web Protocols
- T1071.002 File Transfer Protocols
- T1071.003 Mail Protocols
- T1074.001 Local Data Staging
- T1078.003 Local Accounts
- T1082 System Information Discovery
- T1083 File and Directory Discovery
- T1098.007 Additional Local or Domain Groups
- T1102.001 Dead Drop Resolver
- T1102.002 Bidirectional Communication
- T1105 Ingress Tool Transfer
- T1106 Native API
- T1111 Multi-Factor Authentication Interception
- T1112 Modify Registry
- T1113 Screen Capture
- T1114.002 Remote Email Collection
- T1114.003 Email Forwarding Rule
- T1115 Clipboard Data
- T1124 System Time Discovery
- T1132.002 Non-Standard Encoding
- T1133 External Remote Services
- T1136.001 Local Account
- T1140 Deobfuscate/Decode Files or Information
- T1176.001 Browser Extensions
- T1185 Browser Session Hijacking
- T1190 Exploit Public-Facing Application
- T1204.001 Malicious Link
- T1204.002 Malicious File
- T1204.004 Malicious Copy and Paste
- T1205 Traffic Signaling
- T1217 Browser Information Discovery
- T1218.005 Mshta
- T1218.010 Regsvr32
- T1218.011 Rundll32
- T1219.002 Remote Desktop Software
- T1480.002 Mutual Exclusion
- T1489 Service Stop
- T1497.001 System Checks
- T1505.003 Web Shell
- T1518.001 Security Software Discovery
- T1534 Internal Spearphishing
- T1539 Steal Web Session Cookie
- T1543.003 Windows Service
- T1546.001 Change Default File Association
- T1547.001 Registry Run Keys / Startup Folder
- T1550.002 Pass the Hash
- T1552.001 Credentials In Files
- T1552.004 Private Keys
- T1553.002 Code Signing
- T1555.003 Credentials from Web Browsers
- T1557 Adversary-in-the-Middle
- T1559.001 Component Object Model
- T1560.001 Archive via Utility
- T1560.003 Archive via Custom Method
- T1564.002 Hidden Users
- T1564.003 Hidden Window
- T1564.011 Ignore Process Interrupts
- T1566 Phishing
- T1566.001 Spearphishing Attachment
- T1566.002 Spearphishing Link
- T1567.002 Exfiltration to Cloud Storage
- T1568 Dynamic Resolution
- T1583 Acquire Infrastructure
- T1583.001 Domains
- T1583.004 Server
- T1583.006 Web Services
- T1584.001 Domains
- T1585 Establish Accounts
- T1585.001 Social Media Accounts
- T1585.002 Email Accounts
- T1586.002 Email Accounts
- T1587 Develop Capabilities
- T1587.001 Malware
- T1588.002 Tool
- T1588.003 Code Signing Certificates
- T1588.005 Exploits
- T1589.002 Email Addresses
- T1589.003 Employee Names
- T1591 Gather Victim Org Information
- T1593.001 Social Media
- T1593.002 Search Engines
- T1594 Search Victim-Owned Websites
- T1596 Search Open Technical Databases
- T1598 Phishing for Information
- T1598.003 Spearphishing Link
- T1608.001 Upload Malware
- T1620 Reflective Code Loading
- T1657 Financial Theft
- T1660 Phishing
- T1678 Delay Execution
- T1680 Local Storage Discovery
- T1682 Query Public AI Services
- T1684.001 Impersonation
- T1685 Disable or Modify Tools
- T1686 Disable or Modify System Firewall
Software 19
- Mimikatz
- PsExec
- gh0st RAT
- schtasks
- certutil
- Gold Dragon
- Brave Prince
- QuasarRAT
- NOKKI
- BabyShark
- KGH_SPY
- CSPY Downloader
- AppleSeed
- Amadey
- Troll Stealer
- GoBear
- Gomir
- TRANSLATEXT
- HTTPTroy
Principal sources 1,607 reports
Ranked by how many of this actor's indicators each report brought in.
- 2,251x.com/skocherhan/status/2047382182000312798
- 2,251x.com/skocherhan/status/2048153192563613921
- 1,505medium.com/@meeswicky1100/dprk-unc3782-d66329e5c071
- 1,505github.com/Meesvanwickeren/Threat_Intel/blob/main/…
- 990virustotal.com/gui/ip-address/208.73.209.42/relations
- 613x.com/blackorbird/status/2054518266958320099
- 613mp.weixin.qq.com/s/Ibz3FeA7twg-VCujA3cV_g
- 613virustotal.com/gui/ip-address/112.216.9.171/relations
Related groups 13
What the sources have in common — not a claim that these are the same actor. See the whole graph.
5 more in the relationship graph.
Timeline 25,678 indicators
Each entry is a batch of indicators that appeared upstream on one date, under the report it was filed with.
300 shown
Showing the 300 most recent of 25,678. Complete: G0094.json.
No indicator matches. Only the most recent 300 are on this page — the rest are in the JSON.
-
x.com/skocherhan/status/2047382182000312798 · x.com/skocherhan/status/2048153192563613921
aberta.dynu.net ability.dynuddns.com accaverify.dynu.org accbverify.dynu.org acchiverify.dynu.org aispertes.dynu.net aispertes.dynuddns.net aleo.dynuddns.com anhyuse.dynu.net appinfoercm.dynu.net appinfoercms.dynu.net brahmastra.today ceo.mmm.mmm.mmm.dynuddns.net cmoisere.dynuddns.net edoc.invoice.dynu.net edoc.invoice.dynuddns.com edoc.invoice.dynuddns.net eredsaa.dynu.net eredsaa.dynu.org eredsaa.dynuddns.net ertnhiso.dynu.net etnhisr.dynuddns.net incoming.dynu.org invoice.dynu.net invoice.dynuddns.com invoice.dynuddns.net mmm.dynu.net mmm.dynuddns.net moisopeq.dynu.net moisqit.dynu.net msdnsntns.dynu.net msdntusne.dynu.net msdntusne.dynuddns.com nchdocmnt.dynuddns.com ncodhincheck.dynu.org ncodhipass.dynu.org ncodhiverify.dynu.org ncodhjpass.dynu.org ndindocnt.dynuddns.com ndsmnidne.dynu.net ndsmnidne.dynuddns.com nhis.edoc.invoice.dynu.net nhis.edoc.invoice.dynuddns.com nhis.edoc.invoice.dynuddns.net nhis.mmm.mmm.mmm.dynu.net nhis.mmm.mmm.mmm.dynuddns.net nhisconfigopt.dynu.net nhisconfigopts.dynu.net nhyuis.dynu.net nportalch.dynu.net nslsbgode.dynuddns.com ntesyh.dynu.net ntnmid.dynu.net ntnmid.dynuddns.com ntpayloaden.dynu.net ntpayloadens.dynu.net picorpe.dynu.net picorpe.dynu.org piscorps.dynu.net pisecors.dynuddns.net ripwor.com station.dynu.org -
x.com/skocherhan/status/2047382182000312798 · x.com/skocherhan/status/2048153192563613921
accverify.dynu.org achannelapp.dynu.net achannelapps.dynu.net aisperte.dynuddns.net arecedpos.dynu.net arecedposo.dynu.net arecepppp.dynu.org cmoiser.dynuddns.net content.dynuddns.net exrnhis.dynu.org exrnhis.dynuddns.net gemini.dynuddns.com immutable.dynu.net immutable.dynuddns.com immutable.dynuddns.net immutable.roxa.org immutable.yyuyy.com inblogpublishs.dynu.net mdlsnchlog.dynuddns.com nblogauth.dynuddns.com ncodhencheck.dynu.org ncodhepass.dynu.org ncodheverify.dynu.org ncodhgncheck.dynu.org ncodhgpass.dynu.org ncodhgverify.dynu.org ndlchklog.dynu.org ndocagcheck.dynv6.net neosxrg.dynu.org nhis.content.dynuddns.net nhis.gemini.dynuddns.com nhis.immutable.dynu.net nhis.immutable.dynuddns.com nhis.immutable.dynuddns.net nhis.immutable.roxa.org nhis.immutable.yyuyy.com nhis.security.dynuddns.net nhis.xrp.dynuddns.net nlsmintms.dynu.org oopp.dynu.net security.dynuddns.net xrp.dynuddns.net -
x.com/skocherhan/status/2047382182000312798 · x.com/skocherhan/status/2048153192563613921
ansdocpool.dynu.net ansdocpools.dynu.net bridge.dynuddns.net ilsmdoeit.dynu.org inblogpublish.dynu.net msindmsit.dynu.org nhis.bridge.dynuddns.net nhis.proxy.dynuddns.net nhis.random.dynu.org notxrg.dynu.org ntxentireml.dynu.net ntxentiremls.dynu.net proxy.dynuddns.net random.dynu.org -
x.com/skocherhan/status/2047382182000312798 · x.com/skocherhan/status/2048153192563613921
cmioser.dynu.net gama.dynu.org gama.dynuddns.com gama.dynuddns.net nhis.gama.dynu.org nhis.gama.dynuddns.com nhis.gama.dynuddns.net recnhis.dynu.net recnhis.dynu.org -
x.com/skocherhan/status/2047382182000312798 · x.com/skocherhan/status/2048153192563613921
abntxrg.dynu.org abntxrg.dynuddns.net activate.dynu.net activate.dynu.org activate.dynuddns.net actor.dynu.org actor.dynuddns.net aipert.dynuddns.net aipsocs.dynuddns.net arcnhis.dynu.net auth-accounts.dynu.org cmioepr.dynu.net cnhisrps.dynuddns.net ctpnhis.dynu.net download.groups.id emiosscap.dynu.net image.blinklab.com miosscap.dynuddns.net msverfmst.dynu.org nahispe.dynu.net nahispe.dynuddns.net navdistnd.dynu.net nchecknts.dynu.net ncodhcncheck.dynu.org ncodhcpass.dynu.org ncodhcverify.dynu.org ncodhdncheck.dynu.org ncodhdpass.dynu.org ncodhdverify.dynu.org ndistmstm.dynu.net ndistmstm.dynu.org nehispe.dynu.net nhis.activate.dynu.net nhis.activate.dynu.org nhis.activate.dynuddns.net nhis.actor.dynu.net nhis.actor.dynu.org nhis.actor.dynuddns.net nhis.random.dynuddns.com nhis.random.dynuddns.net nhis.ssl.dynu.org nhis.ssl.dynuddns.com nhis.ssl.dynuddns.net nhis.treat.dynu.net nhis.treat.dynu.org nhis.treat.dynuddns.net npublishblog.dynu.net npublishblogs.dynu.net nsidmstnd.dynu.net nslsndmis.dynu.org nsminidms.dynu.org nsv-mnstm.dynu.net ntinvcertificate.dynu.net ntinvcertificates.dynu.net nuinsconfirm.dynu.net nuinsconfirms.dynu.net nverfsnts.dynu.net pentxer.dynu.net publishndoc.dynu.net random.dynuddns.com random.dynuddns.net rhkrgun.dynu.net ssl.dynu.org ssl.dynuddns.com ssl.dynuddns.net treat.dynu.net treat.dynu.org treat.dynuddns.net xpentr.dynu.net xpentr.dynuddns.net -
x.com/skocherhan/status/2047382182000312798 · x.com/skocherhan/status/2048153192563613921
abcdef.dynuddns.com abcdef.yyuyy.com abntxe.dynu.net accuse.dynu.net accuse.dynu.org accuse.dynuddns.net action.dynuddns.net ca-fe-nhn.com chkidsuts.dynu.org cipsocs.dynu.org cipsocs.dynuddns.net cnxhisrps.dynuddns.net dev-crm.daliajobs.com encorpverify.dynu.net encorpverifys.dynu.net inrestrictblock.dynu.net login-accounts.dynu.net miosscop.dynuddns.net ncodhbncheck.dynu.org ncodhbnpass.dynu.org ncodhbpass.dynu.org ncodhbverify.dynu.org ndlsidnts.dynu.net nhis.accuse.dynu.net nhis.accuse.dynu.org nhis.accuse.dynuddns.net nhis.action.dynu.net nhis.action.dynuddns.net nsmditstn.dynu.net ntinvoicekdoc.dynu.net nvlsndisn.dynu.net nvservemd.dynu.org pshidusnt.dynu.org usrntxverify.dynu.net usrntxverifys.dynu.net usrrightcorp.dynu.net usrrightcorps.dynu.net wjswkanstj.dynu.org -
x.com/skocherhan/status/2047382182000312798 · x.com/skocherhan/status/2048153192563613921
abandon.dynuddns.net able.dynu.org about.dynu.net about.dynuddns.net absorb.dynuddns.net abstract.dynuddns.net abuse.dynu.org accident.dynu.org accident.dynuddns.net account.dynu.net account.dynuddns.net accs.dynu.net app.donply.pw auction.dynu.net checkmend.dynu.org cnhisrps.dynu.net docservices.dynu.net edoc.abstract.dynuddns.net edoc.view.dynu.net edocservice-kakao.dynu.net explorentdoc.dynu.net hslnistms.dynu.org hsnivnidl.dynu.net inrestrictblocks.dynu.net locnhis.dynu.org midnsidsl.dynu.net mlsintms.dynu.org mois-news.dynu.org moisedow.dynu.net moisedow.dynuddns.net moiselow.dynuddns.net moscop.dynu.net moscop.dynuddns.net msdnsmt.dynu.org msdtnsmsu.dynu.org msnhor.dynu.org msutsidmc.dynu.org naver.dynu.org ncodgtcheck.dynu.org ncodgtnpass.dynu.org ncodgtverify.dynu.org ncodgucheck.dynu.org ncodguverify.dynu.org ncodgvcheck.dynu.org ncodgvnpass.dynu.org ncodgvverify.dynu.org ncodgxcheck.dynu.org ncodhancheck.dynu.org ncodhanpass.dynu.org ncodhaverify.dynu.org ncsmtcres.dynu.org nhis-edoc-cigarette.dynuddns.net nhis-edoc-sign.dynuddns.net nhis.abandon.dynuddns.net nhis.able.dynu.org nhis.about.dynu.net nhis.about.dynuddns.net nhis.absorb.dynuddns.net nhis.abuse.dynu.net nhis.abuse.dynu.org nhis.accident.dynu.org nhis.accident.dynuddns.net nhis.account.dynu.net nhis.account.dynuddns.net nhis.dynuddns.net · 31 more in this batch, in the JSON
Further reading 1,622
- asert.arbornetworks.com/stolen-pencil-campaign-targets-academia
- attack.mitre.org/groups/G0094
- blog.alyac.co.kr/2234
- blog.alyac.co.kr/attachment/cfile5.uf@99A0CD415CB67E210D…
- blog.cloudflare.com/2026-threat-report
- blog.malwarebytes.com/threat-analysis/2021/06/kimsuky-apt-con…
- global.ahnlab.com/global/upload/download/techreport/%5BAn…
- learn.microsoft.com/en-us/microsoft-365/security/intelligen…
- securelist.com/the-kimsuky-operation-a-north-korean-ap…
- services.google.com/fh/files/misc/apt43-report-en.pdf
- threatconnect.com/blog/kimsuky-phishing-operations-puttin…
- us-cert.cisa.gov/ncas/alerts/aa20-301a
- cybereason.com/blog/back-to-the-future-inside-the-kims…
- microsoft.com/en-us/security/blog/2024/02/14/staying-…
- proofpoint.com/us/blog/threat-insight/social-engineeri…
- rapid7.com/cdn/assets/bltc1ddd6561ab54a26/69ba67de…
- security.com/threat-intelligence/springtail-kimsuky-…
- zdnet.com/article/cyber-espionage-group-uses-chro…
- app.validin.com/detail?find=a93338c41c541aecef925758499…
- virustotal.com/gui/file/4dcf742b02386c7ed4a2b4582de9bf…
- x.com/byrne_emmy12099/status/1818113597677223…
- virustotal.com/gui/ip-address/158.247.210.44/relations
- twitter.com/DeadlyLynn/status/1314181830162083841
- x.com/skocherhan/status/2045963626901897341
- virustotal.com/gui/file/1fd4cdad8d32dc17513b4e4a79f42c…
- virustotal.com/gui/ip-address/79.133.51.174/relations
- virustotal.com/gui/ip-address/192.109.119.104/relations
- x.com/skocherhan/status/2033994044393627913
- app.validin.com/detail?find=1.214.206.78&type=ip4&ref_i…
- virustotal.com/gui/file/7a45a529b275cfaa6ebde88bf00413…
- x.com/byrne_emmy12099/status/1876515884044546…
- virustotal.com/gui/ip-address/27.102.66.162/relations
- twitter.com/asdasd13asbz/status/1762014640274637280
- app.validin.com/detail?find=210.92.18.170&type=ip4&ref_…
- twitter.com/fmc_nan/status/1635537014891372545
- virustotal.com/gui/ip-address/27.102.127.115/relations
- app.validin.com/detail?type=ip&find=67.217.60.68#tab=re…
- twitter.com/InQuest/status/1521136176530436098
- github.com/rapid7/Rapid7-Labs/blob/main/IOCs/Kimsu…
- twitter.com/blackorbird/status/1082553543280680962
1,582 more, and the report behind every indicator, in G0094.json.