Quick links
Press Enter to search, Esc to close
Threat group profile
Attributed by the US and South Korean governments to North Korea's Reconnaissance General Bureau, Kimsuky sends convincing fake emails to think tanks, researchers, media and government staff to steal documents and email.
In short
Attributed by the US and South Korean governments to North Korea's Reconnaissance General Bureau, Kimsuky sends convincing fake emails to think tanks, researchers, media and government staff to steal documents and email. South Korea and the US Treasury sanctioned it in 2023, and the FBI reported new QR code phishing from it in 2025.
Public reports use several names for this activity.
| Name | Where it appears |
|---|---|
| Kimsuky | MITRE ATT&CK G0094 (group name); CISA advisory AA20-301A; US advisories of 2023 and 2024[1, 2, 6, 8] |
| Black Banshee | MITRE Associated Groups; US Treasury notice of 30 November 2023; US advisories of 2023 and 2024[1, 3, 6, 8] |
| Velvet Chollima | MITRE Associated Groups; US Treasury notice; BfV and NIS advisory; US advisories of 2023 and 2024[1, 3, 4, 6, 8] |
| Emerald Sleet | MITRE Associated Groups; US Treasury notice; US advisory of 2024[1, 3, 8] |
| THALLIUM | MITRE Associated Groups; BfV and NIS advisory (as Thallium); US advisory of 2023[1, 4, 6] |
| APT43 | MITRE Associated Groups; US Treasury notice; US advisories of 2023 and 2024[1, 3, 6, 8] |
| TA406 | US Treasury notice of 30 November 2023 only; not on the MITRE list[3] |
| TA427 | MITRE Associated Groups only[1] |
| Springtail | MITRE Associated Groups only[1] |
| Earth Kumiho | MITRE Associated Groups only[1] |
| PatheticSlug | MITRE Associated Groups only[1] |
Attribution is a judgment by the body named. It is shown here as attributed, not as proven fact.
MITRE ATT&CK Version 5.2, last modified 31 July 2026
Describes Kimsuky as a DPRK-based cyber espionage group active since at least 2012, and says its operations have overlapped with other North Korean actors.[1]
CISA, FBI and US Cyber Command CNMF 27 October 2020
Said Kimsuky has most likely operated since 2012 and is most likely tasked by the North Korean regime with a global intelligence gathering mission.[2]
German BfV and South Korean NIS 20 March 2023
Assessed that the actor has already targeted Korean and German entities with spearphishing emails. A footnote says members of the IT security community regularly link Kimsuky to the RGB.[4, 5]
FBI, US State Department and NSA, with South Korea's NIS, National Police Agency and Foreign Ministry 1 June 2023
Said Kimsuky is administratively subordinate to an element within the RGB and has run campaigns for the RGB since at least 2012.[6]
South Korean government (joint press release) 2 June 2023
Said Kimsuky is a body under the RGB that has carried out cyber attacks for more than ten years, and designated it for sanctions.[7]
South Korean government (joint press release) 2 June 2023
Said Kimsuky has carried out ransomware attacks and demanded ransom, and that Kimsuky and other North Korean groups stole weapons and satellite technology. The US sources in this profile do not make these two claims.[7]
US Department of the Treasury 30 November 2023
Said Kimsuky is subordinate to the RGB, active since 2012, and designated it under E.O. 13687.[3]
FBI, US State Department and NSA 2 May 2024
Said Kimsuky is administratively subordinate to the 63rd Research Center, an element within the RGB.[8]
FBI 8 January 2026
Said that as of 2025 Kimsuky actors targeted think tanks, academic institutions and governments with malicious QR codes in spearphishing.[9]
Sources differ on how Kimsuky relates to the RGB. MITRE ATT&CK calls it DPRK-based and does not name a unit. The US Treasury (30 November 2023) says it is subordinate to the RGB. The June 2023 US and South Korean advisory says it is administratively subordinate to "an element within" the RGB, and the May 2024 FBI, State Department and NSA advisory names that element as the 63rd Research Center. The BfV and NIS (March 2023) go less far: a footnote says members of the IT security community regularly link Kimsuky to the RGB. Sources also differ on one alias: the Treasury lists TA406, while MITRE lists TA427. On aims, US sources describe intelligence collection, while South Korea's June 2023 release also says Kimsuky has carried out ransomware attacks. Finally, MITRE notes that some researchers put all North Korean state-sponsored activity under Lazarus Group instead of tracking separate subgroups.
Each entry is attributed to the group by the sources cited.
MITRE says Kimsuky was assessed to be responsible for the 2014 Korea Hydro & Nuclear Power Co. compromise.[1]
CISA says an extension on the Google Chrome Web Store was used to infect victims and steal passwords and cookies.[2]
MITRE lists Operation Kabar Cobra and Operation Smoke Screen as notable 2019 campaigns.[1]
AA20-301A describes Kimsuky's methods, targets and mitigations.[2]
MITRE says Kimsuky was observed using commercial large language models for vulnerability research, scripting, social engineering and reconnaissance.[1]
The Treasury designates Kimsuky under E.O. 13687.[3]
The 2024 advisory shows an email inviting an expert to speak at a think tank workshop, sent to US officials and others at international organizations.[8]
The FBI, State Department and NSA say Kimsuky exploits weak DMARC policies to hide spoofed emails.[8]
The FBI reports emails posing as a foreign advisor and an embassy employee, each with a QR code.[9]
The FBI reports an email to a strategic advisory firm with a QR code that led to a fake Google sign-in page.[9]
MITRE says HTTPTroy was first reported in October 2025 and has been seen in operations attributed to DPRK-affiliated actors including Kimsuky.[17]
The FBI warns NGOs, think tanks and academia about Kimsuky's QR code spearphishing and lists mitigations.[9]
Indictments, sanctions and advisories that name the group or its alleged members.
| Date | Who | What |
|---|---|---|
| 27 October 2020 | CISA, FBI and US Cyber Command CNMF | Joint advisory (AA20-301A)Described how Kimsuky works and named safeguards against spearphishing, multi-factor authentication and user awareness training as the key mitigations.[2] |
| 20 March 2023 | German BfV and South Korean NIS | Joint advisoryWarned of Kimsuky campaigns against Google browser and app store services aimed at experts on the Korean Peninsula.[4, 5] |
| 1 June 2023 | FBI, US State Department and NSA with South Korea's NIS, National Police Agency and Foreign Ministry | Joint advisory (CSA-20230601-1)Set out Kimsuky's social engineering, warning signs and mitigations, and noted that information on illicit DPRK cyber activity could earn a Rewards for Justice award of up to 5 million dollars.[6] |
| 2 June 2023 | South Korean government (Financial Services Commission release) | Sanctions designationDesignated Kimsuky for sanctions, which it says was a world first, and listed the virtual currency wallet addresses it identified.[7] |
| 30 November 2023 | US Department of the Treasury (OFAC) | SanctionsDesignated Kimsuky under E.O. 13687. Property of the designated persons in the US is blocked.[3] |
| 2 May 2024 | FBI, US State Department and NSA | Joint advisory (JCSA-20240502-001)Warned that Kimsuky exploits weak DMARC policies and advised a DMARC policy of quarantine or reject.[8] |
| 8 January 2026 | FBI | FLASH alert (AC-000001-MW)Alerted NGOs, think tanks and academia to QR code spearphishing and listed mitigations.[9] |
Techniques reported for this group, by MITRE ATT&CK tactic.
Phishing: Spearphishing Attachment T1566.001
The 2023 advisory says the first email is often harmless and that attached malicious documents are often password-protected.[1, 6]
Phishing: Spearphishing Link T1566.002
MITRE says emails linked to macro documents or actor-controlled domains. The FBI reports 2025 QR code emails that led to a fake sign-in page.[1, 9]
Exploit Public-Facing Application T1190
MITRE says the group exploited flaws for initial access, including the Microsoft Exchange flaw CVE-2020-0688.[1]
BabyShark Script-based malware
MITRE describes a Visual Basic script malware family believed to be associated with several North Korean campaigns.[1, 10]
AppleSeed Backdoor
MITRE says Kimsuky used it against South Korean government, academic and commercial targets since at least 2021.[1, 11]
TRANSLATEXT Malicious browser extension
MITRE says it posed as a Google Translate extension for Chrome and is four malicious JavaScript files.[1, 12]
KGH_SPY Modular tool suite
MITRE says Kimsuky used it for reconnaissance, information stealing and backdoor access.[1, 13]
Troll Stealer Information stealer
MITRE describes a stealer written in Go that is associated with Kimsuky operations.[1, 14]
GoBear Backdoor
MITRE describes a Go-based backdoor that abuses stolen certificates to avoid detection.[1, 15]
Gomir Linux backdoor
MITRE describes a Linux version of GoBear associated with Kimsuky operations.[1, 16]
HTTPTroy Backdoor
MITRE describes an obfuscated backdoor first reported in October 2025 and seen in operations including Kimsuky.[1, 17]
Mimikatz Credential dumping tool
MITRE says Kimsuky gathered credentials using Mimikatz and ProcDump.[1, 18]
Also linked in our threat library:
Use mobile device or endpoint tools that analyze QR-linked web addresses, and log credential entry after QR scans.
Counters T1566.002
Secure and closely monitor Remote Desktop Protocol and other remote services, and check for unexpected remote access tools.
Counters T1219.002
Install updates for operating systems, software and firmware promptly, and put known exploited flaws first.
Counters T1190
Spot look-alike domains and fake sign-in pages that copy your organization or your partners, the kind the advisories describe.
Check for fake profiles and accounts that imitate your senior staff and public experts, since the advisories describe posing as real journalists, academics and think tank staff.
Watch for leaked or sold company credentials and mailbox data, since the 2023 advisory says compromised accounts help the group write convincing emails.
Follow what governments publish about this group and compare its listed techniques with your own controls.
See which mail and remote access services face the internet so known flaws, such as the Exchange flaw MITRE names, can be fixed.
MITRE ATT&CK describes Kimsuky as a DPRK-based cyber espionage group active since at least 2012. The US Treasury (30 November 2023) says it is subordinate to North Korea's Reconnaissance General Bureau, and the FBI, State Department and NSA (2 May 2024) name the 63rd Research Center within it.
The Treasury lists government, research centers, think tanks, academic institutions and news media in Europe, Japan, Russia, South Korea and the US. MITRE adds the United Nations, business services and manufacturing, and CISA adds the cryptocurrency industry.
Mainly by spearphishing. The FBI, State Department and NSA describe emails posing as journalists, academics and experts, often starting with a harmless message to build trust. The FBI reported QR code emails in 2025.
The FBI FLASH of 8 January 2026 reports Kimsuky campaigns in May and June 2025, and MITRE last updated its group page on 31 July 2026.
Set DMARC to quarantine or reject, require phishing-resistant multi-factor authentication on email and remote access, and tell staff to check unknown contacts by phone or video before opening files or scanning QR codes.
The FBI asks for a report at ic3.gov using #KimsukyCSA. South Korean organizations can contact the NIS (111), the police (182) or KISA (118).
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.