Kimsuky (Velvet Chollima, Emerald Sleet, THALLIUM, Black Banshee, APT43), Adversary Emulation Profile

Kimsuky (MITRE ATT&CK G0094) is a DPRK-based cyber-espionage group attributed to North Korea's Reconnaissance General Bureau (RGB), specifically the 63rd Research Center, operating since at least 2012. Initially focused on South Korean government entities and think tanks, the group has expanded its aperture to the United States, Japan, Russia, and Europe, consistently targeting individuals and organizations with insight into Korean Peninsula foreign policy, nuclear policy, sanctions, and defense issues. Kimsuky is distinguished by its heavy investment in social engineering and credential phishing over zero-day exploitation: the group impersonates journalists, researchers, diplomats, and think-tank personnel in long-running correspondence campaigns to build trust before delivering malicious payloads or harvesting credentials. Its tooling ranges from commodity RATs (QuasarRAT, gh0st RAT) to a stable of bespoke malware families (BabyShark, AppleSeed, Gold Dragon, KONNI, Troll Stealer) and malicious browser extensions (TRANSLATEXT). Since 2023, Kimsuky has been observed leveraging commercial LLMs for target research and vulnerability analysis, and adopting ClickFix-style social engineering to trick victims into self-executing malicious PowerShell.

Attribution & motivation