Kimsuky Blends AI-Generated Lures and Quishing into an Expanded Espionage Arsenal

Red | Actor

Active since: 2012

Targeted Regions: South Korea, United States, Japan, Vietnam, Thailand, Brazil, Germany, Russia, Canada, and broader Europe, including Belgium, Bulgaria, Croatia, Czech Republic, Denmark, Estonia, Finland, France, Greece, Hungary, Iceland, Italy, Latvia, Lithuania, Luxembourg, Montenegro, Netherlands, North Macedonia, Norway, Poland, Portugal, Romania, Slovakia, Slovenia, and Albania. East Asia, Southeast Asia, Asia-Pacific, and North America are described as regional focus areas.

Targeted Platforms: Windows, Android, Linux, macOS, and cloud or web services and VPN portals

Targeted Products: GitHub, Pastebin, Dropbox, Slack, Cloudflare Quick Tunnels, Visual Studio, Microsoft 365, Okta

Targeted Industries: Government, Public Administration, Defense, Think Tanks, Policy Research Institutes, Academia, Universities, NGOs, Human Rights Organizations, Media, Healthcare, Machinery, Energy, Nuclear Power Operations, Manufacturing, Business Services, Legal Services, Construction, Financial, Insurance, Retail, Cryptocurrency

Threat Actor: Kimsuky (aka APT43, Thallium, Velvet Chollima, Black Banshee, Emerald Sleet, Ruby Sleet, Sparkling Pisces, Springtail, TA427, TA406, Earth Kumiho, PatheticSlug, ARCHIPELAGO, SharpTongue, ITG16, Greendinosa, RGB-D5, Cerium)

Malware: AppleSeed (KGH_SPY), AlphaSeed, HappyDoor, PebbleDash, HelloDoor, httpMalice, httpTroy, MemLoad, HTTPSpy, AsyncRAT, BabyShark, GoldDragon, KLogEXE, Troll Stealer, Gomir, NavRAT, NikiHTTP, NikiTeaR, ComeBacker, DRATzarus, FastFire, FastSpy, FlowerPower, RandomQuery, Yorekey, Grease, TRANSLATEXT, QuasarRAT, Gh0st RAT, KimJongRAT, CSPY Downloader, BITTERSWEET, VENOMBITE, xRAT, MailFetch.py, Reger Dropper, Pidoc Dropper

Campaign Names: Operation GitPower, quishing (QR code phishing) campaigns, and Operation Kabar Cobra

History

Timeline

Date	Event
2012	Kimsuky active since at least 2012
2019	Kimsuky attacks South Korea’s defense and media sectors; malware filed as “Cobra”, mutex “KABAR”
2023	Operation Kabar Cobra conducted
May 2025	First recorded Kimsuky use of commercial LLMs
August 2026	Operation GitPower conducted; multiple quishing campaigns target think tanks and U.S. entities

Analysis

Actor Details

Kimsuky is a Democratic People’s Republic of Korea state-sponsored cyber espionage group that has been operating since at least 2012. It is tracked across the vendor landscape as APT43, Thallium, Velvet Chollima, Black Banshee, Emerald Sleet, Ruby Sleet, Sparkling Pisces, Springtail, TA427, TA406, Earth Kumiho, PatheticSlug, ARCHIPELAGO, SharpTongue, and ITG16. Kimsuky’s priorities center on foreign policy and national security matters tied to the Korean Peninsula, nuclear policy, and sanctions, and the group supplements espionage with revenue-generating cybercrime that, in the most recent reporting, extends to cryptocurrency exchanges, DeFi platforms, and token fundraising operations.

In 2019, the Kimsuky group mounted a sustained campaign of attacks against South Korea’s defense-related organizations and media companies; the attackers were recently found to be targeting several enterprises, including those dealing in cryptocurrencies, for financial gain. A spate of malware was distributed with the file name “Cobra,” and a mutex called “KABAR” was identified in several of the attacks.

Initial access is overwhelmingly social: spear-phishing emails carrying compressed archives with LNK, CHM, JSE, PIF, SCR, HTA, HWP, and Office attachments; spoofed security software and Cisco Webex installation pages, in one case built around genuine meeting schedules the operators are assessed to have obtained through prior device or account compromise; counterfeit B2B messaging service installers aimed at administrators; and weaponized QR codes embedded in spearphishing emails that steer victims either to mobile-optimized credential harvesting pages impersonating Microsoft 365, Okta, and VPN portals or to trojanized Android APK downloads. The group also exploits external remote services and public-facing applications, naming CVE-2017-11882 and CVE-2019-0708, plus CVE-2018-0802, CVE-2019-1405, CVE-2020-0787, CVE-2024-1709, and CVE-2025-48703.

Operation GitPower, run in August 2026, shows how the current Windows attack works. The victim receives a ZIP file containing a Windows shortcut dressed up as a Korean business document, with a Chrome icon and a forged 2023 timestamp. Opening it runs a scrambled PowerShell command that the operators pushed past the visible edge of the shortcut’s Properties window using roughly 300 blank spaces, so the file looks harmless on inspection. That command rebuilds a second script inside the user’s AppData folder and runs it in a hidden window. Before anything else, the malware checks whether it is being watched, looking for virtual machine services, common analysis tools, and a known sandbox username, and it wipes the PowerShell command history behind it. It then creates a scheduled task that fires every few minutes under a name imitating BitLocker, MATLAB, or a .NET component, each carrying a small spelling error that is easy to miss.

The group targets keystrokes, clipboard contents, screenshots, documents, stored browser credentials, credentials held in memory, and the session tokens that support multi-factor authentication. The keylogger writes captured data to a file named to resemble an Office configuration file and uploads it at intervals of roughly one to two hours, using browser identifiers that differ slightly from the legitimate strings. Within the toolset, AppleSeed is responsible for document theft and for collecting South Korean government GPKI certificates, while the PebbleDash family provides remote control and reconnaissance.

Command and control is routed through services that most organizations already permit. Payloads are retrieved from GitHub and Pastebin, stolen data is sent out through Dropbox and Slack, and part of the infrastructure is hosted on compromised South Korean websites. The remainder uses free Korean dynamic DNS domains registered in volume and rotated frequently across providers in Korea, Hong Kong, Canada, and the United States. Command traffic is encrypted, and the malware executes commands under a Korean code page, which is consistent with the intended victim set.

Profile

Actor Group

Name	Origin	Motive	Target Industries
Kimsuky (aka APT43, Thallium, Velvet Chollima, Black Banshee, Emerald Sleet, Ruby Sleet, Sparkling Pisces, Springtail, TA427, TA406, Earth Kumiho, PatheticSlug, ARCHIPELAGO, SharpTongue, ITG16, G0094)	North Korea (DPRK)	Espionage, Financial Gains	Government, Public Administration, Defense, Think Tanks, Policy Research Institutes, Academia, Universities, NGOs, Human Rights Organizations, Media, Healthcare, Machinery, Energy, Nuclear Power Operations, Manufacturing, Business Services, Legal Services, Construction, Financial, Insurance, Retail, Cryptocurrency

Guidance

Recommendations

Hunt the Scheduled Task Names Directly

Query for tasks named Edge Updater, ChromeUpdate, EdgeUpdate, ChromeCheck, and EdgeCheck, plus any task whose name pairs a real product name with a misspelling or a long numeric string, such as “BitLockor Encrypter All Drives”. Hidden tasks running PowerShell or regsvr32 at 5–60 minute intervals are the single most consistent persistence artifact.

Detect Shortcut Files with Oversized Arguments

Build detection for LNK files whose command-line argument field exceeds a few hundred characters or contains long runs of whitespace, and for LNK files delivered inside ZIP archives. Roughly 300 leading spaces and 5,800–9,500 character PowerShell arguments are the Operation GitPower fingerprint.

Alert on Headless Console and Hidden Window Execution

Flag conhost.exe launched with --headless, powershell.exe with -windowstyle hidden, and PowerShell child processes spawned by hh.exe, wscript.exe, or explorer.exe following archive extraction.

Monitor Signed Binary Proxy Execution

Watch for regsvr32.exe and rundll32.exe loading DLLs from C:\ProgramData, C:\Users\Public, and %TEMP%, and for certutil.exe performing decode operations against files under %USERPROFILE%\Links.

Restrict and Inspect Developer Tunnelling Tools

Treat Visual Studio Code Remote Tunnels, Cloudflare Quick Tunnels, and Ngrok as remote access software subject to allowlisting, and alert on the VS Code CLI executing from C:\Users\Public or on ‘code tunnel’ invocations on hosts with no development role.

Govern Unsanctioned Remote Administration Software

Block or alert on DWAgent installation, the DWService service name, dwagsvc.exe, listener port 7950, and connections to dwservice.net relay nodes.

Inspect GitHub, Pastebin, and Cloud Storage Egress

Alert on requests to raw.githubusercontent.com or api.github.com carrying an Authorization: token header from non-developer endpoints, on Pastebin raw path access, and on unexpected Dropbox API or Slack WebHook traffic from workstations.

Protect GPKI Certificate Stores and Code Signing Material

Where South Korean government PKI certificates are used, move them off filesystem paths such as C:\GPKI onto hardware-backed storage, and audit access to that directory.

Mapped Techniques

Potential MITRE ATT&CK TTPs

Reconnaissance

T1589: Gather Victim Identity Information → T1589.002 Email Addresses

T1598: Phishing for Information → T1598.003 Spearphishing Link

T1592: Gather Victim Host Information

Resource Development

T1583: Acquire Infrastructure → T1583.001 Domains

T1585: Establish Accounts → T1585.003 Cloud Accounts

T1586: Compromise Accounts → T1586.002 Email Accounts

T1587: Develop Capabilities → T1587.001 Malware

T1588: Obtain Capabilities → T1588.002 Tool, T1588.007 Artificial Intelligence

T1682: Query Public AI Services

Initial Access

T1566: Phishing → T1566.001 Spearphishing Attachment, T1566.002 Spearphishing Link

T1660: Phishing (Mobile)

T1078: Valid Accounts → T1078.003 Local Accounts

T1190: Exploit Public-Facing Application

T1133: External Remote Services

Execution

T1204: User Execution → T1204.002 Malicious File

T1059: Command and Scripting Interpreter → T1059.001 PowerShell, T1059.003 Windows Command Shell, T1059.005 Visual Basic, T1059.007 JavaScript

T1106: Native API

T1203: Exploitation for Client Execution

Persistence

T1053: Scheduled Task/Job → T1053.005 Scheduled Task

T1547: Boot or Logon Autostart Execution → T1547.001 Registry Run Keys / Startup Folder

T1543: Create or Modify System Process → T1543.003 Windows Service

T1098: Account Manipulation

Privilege Escalation

T1055: Process Injection → T1055.001 Dynamic-link Library Injection

Defense Evasion

T1027: Obfuscated Files or Information → T1027.013 Encrypted/Encoded File, T1027.001 Binary Padding

T1140: Deobfuscate/Decode Files or Information

T1036: Masquerading → T1036.005 Match Legitimate Name or Location, T1036.008 Masquerade File Type

T1497: Virtualization/Sandbox Evasion → T1497.001 System Checks

T1622: Debugger Evasion

T1070: Indicator Removal → T1070.003 Clear Command History, T1070.004 File Deletion, T1070.006 Timestomp

T1218: System Binary Proxy Execution → T1218.010 Regsvr32, T1218.011 Rundll32

T1553: Subvert Trust Controls → T1553.002 Code Signing

T1620: Reflective Code Loading

T1564: Hide Artifacts → T1564.004 NTFS File Attributes, T1564.003 Hidden Window

T1562: Impair Defenses → T1562.004 Disable or Modify System Firewall

Credential Access

T1056: Input Capture → T1056.001 Keylogging

T1555: Credentials from Password Stores → T1555.003 Credentials from Web Browsers

T1003: OS Credential Dumping → T1003.001 LSASS Memory

T1557: Adversary-in-the-Middle

T1111: Multi-Factor Authentication Interception

T1539: Steal Web Session Cookie

Discovery

T1082: System Information Discovery

T1057: Process Discovery

T1518: Software Discovery → T1518.001 Security Software Discovery

T1083: File and Directory Discovery

T1087: Account Discovery → T1087.004 Cloud Account

Collection

T1005: Data from Local System

T1113: Screen Capture

T1115: Clipboard Data

T1123: Audio Capture

T1074: Data Staged → T1074.001 Local Data Staging

Command and Control

T1071: Application Layer Protocol → T1071.001 Web Protocols, T1071.003 Mail Protocols

T1102: Web Service → T1102.002 Bidirectional Communication, T1102.001 Dead Drop Resolver

T1573: Encrypted Channel → T1573.001 Symmetric Cryptography

T1572: Protocol Tunneling

T1219: Remote Access Software

T1105: Ingress Tool Transfer

T1001: Data Obfuscation → T1001.001 Junk Data

T1584: Compromise Infrastructure → T1584.004 Server

Exfiltration

T1041: Exfiltration Over C2 Channel

T1567: Exfiltration Over Web Service → T1567.002 Exfiltration to Cloud Storage

T1030: Data Transfer Size Limits

T1020: Automated Exfiltration

Impact

T1657: Financial Theft

T1531: Account Access Removal

Prior Exploitation

CVEs Previously Leveraged by Kimsuky

CVE	Name	Affected Product
`CVE-2017-11882`	Microsoft Office Memory Corruption Vulnerability	Microsoft Office
`CVE-2018-0802`	Microsoft Office Memory Corruption Vulnerability	Microsoft Office, Microsoft Word
`CVE-2019-0708`	BlueKeep (Microsoft Remote Desktop Services RCE)	Windows, Windows Server
`CVE-2019-1405`	Microsoft Windows UPnP Service Privilege Escalation Vulnerability	Windows, Windows Server
`CVE-2020-0787`	Microsoft Windows BITS Improper Privilege Management Vulnerability	Microsoft Windows
`CVE-2024-1709`	ConnectWise ScreenConnect Authentication Bypass Vulnerability	ConnectWise ScreenConnect
`CVE-2025-48703`	CWP Control Web Panel OS Command Injection Vulnerability	CWP (aka Control Web Panel or CentOS Web Panel)

Indicators

Indicators of Compromise (IOCs)

Type	Value
SHA256 (sample)	`1eff237dee95172363bfc0342d0389f809f753a6ec5e6848e57b3fd5482e9793`, `85f8f8a3f28d2956776fbbd0365cdb78ac8dc1e6ed12818ef18caed0bb2f74c8`, `af50f35701916d3909f2727cdcbde1a7af47f46eb8db3996905b1c0725aa133f`, `d7c09e7bf79aa9b786dcd9f870427f4a1110f702646fba9d3835215ad3649d0b`, `a36576a096db24a1c91327eb547dedf52e5bd4b0d4593b88d9593d377585b922`, `981dadc1a7ab50d6ff600a69c904a350fcc2d2050ac94589321f51ac5527c78d`, `18fa10ff013cf82974f00875e23dae48d4d2dc0993a348f8069dd32845de39a1`, `a4f72ce8b5736fe3ca2083cfe21bd51697f12e900e307c357cb8523b8f86e3ec`, `c62677543eeb50e0def44fc75009a7748cdbedd0a3ccf62f50d7f219f6a5aa05`, `e8000ddfddbe120b5f2fb3677abbad901615d1abd01a0de204fade5d2dd5ad0d`, `da79eea1198a1a10e2ffd50fd949521632d8f252fb1aadb57a45218482b9fd89` … see original advisory for MD5/SHA1/full set
Domains (sample)	`www[.]ibizplus[.]n-e[.]kr`, `load[.]serverpit[.]com`, `conference[.]birdriver[.]org`, `download[.]birdriver[.]org`, `hdrgdrfes[.]chickenkiller[.]com`, `pipeline[.]embeddedonline[.]org`, `appview[.]imagetemplate[.]com`, `bigfile[.]jaycloudlab[.]com`, `bigfile[.]crabdance[.]com`, `niscarea[.]com`, `www[.]yespp[.]co[.]kr`, `www[.]pyrotech[.]co[.]kr`, `newjo-imd[.]com`, `nid-log[.]com`, `nid-tax[.]dns[.]army`, `pay-tax[.]dns[.]navy`, `nid-htl[.]duckdns[.]org`, `node896147[.]dwservice[.]net`, `www[.]dwservice[.]net`
Filenames (sample)	`Security_20260811.lnk`, `Visa5499.lnk`, `fgkpxjbgthy.ps1`, `xnciuegwpo.pdf`, `Visa_5499.png`, `api_reference.chm`, `SecurityMaker.chm`, `Link.dat`, `Link.ini`, `Office_Config.xml`, `nos-setup.exe`, `fix-camera.jse`, `mTSTCv8.mdxm`, `spyLoader.dll`, `httpSpy.dll`, `MemLoader.dll`, `security_20260126.scr`, `xipbkmaw.exe`, `dwagsvc.exe`, `config.db`
Mutex	`Global\AlreadyRunning19122345`
Registry Key	`HKCU\Software\Microsoft\Windows\CurrentVersion\Run\MSEdgeUpdateInstaller`
Scheduled Task	`Edge Updater`, `ChromeUpdate`, `EdgeUpdate`, `BitLockor Encrypter All Drives_102974298364124_skillerty`
User Agent	`Chremo/87.0.4280.141`, `Edgo/87.0.664.75`, `HeadlessChrome/151.0.0.0`

Sources

References

What Next?

At Hive Pro, it is our mission to detect the most likely threats to your organization and to help you prevent them from happening.

Book a Demo