# Kimsuky Velvet Chollima

Adversary-emulation profile for Kimsuky (G0094 / Velvet Chollima / Emerald Sleet /...

- Repository: https://github.com/BitterSecurity/Decepticon (6507 stars)
- Category: Writing
- License: Apache-2.0
- Last updated: 2026-11-01
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add BitterSecurity/Decepticon --skill kimsuky-velvet-chollima -g -a claude-code -y`
Codex: `npx skills add BitterSecurity/Decepticon --skill kimsuky-velvet-chollima -g -a codex -y`
Cursor: `npx skills add BitterSecurity/Decepticon --skill kimsuky-velvet-chollima -g -a cursor -y`
Gemini CLI: `npx skills add BitterSecurity/Decepticon --skill kimsuky-velvet-chollima -g -a gemini-cli -y`

## Description

Adversary-emulation profile for Kimsuky (G0094 / Velvet Chollima / Emerald Sleet / THALLIUM / Black Banshee / APT43 / TA427), North Korea's RGB 63rd Research Center cyber-espionage actor.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# Kimsuky (Velvet Chollima, Emerald Sleet, THALLIUM, Black Banshee, APT43), Adversary Emulation Profile

Kimsuky (MITRE ATT&CK **G0094**) is a DPRK-based cyber-espionage group attributed to North Korea's Reconnaissance General Bureau (RGB), specifically the **63rd Research Center**, operating since at least **2012**. Initially focused on South Korean government entities and think tanks, the group has expanded its aperture to the United States, Japan, Russia, and Europe, consistently targeting individuals and organizations with insight into **Korean Peninsula foreign policy, nuclear policy, sanctions, and defense issues**. Kimsuky is distinguished by its heavy investment in **social engineering and credential phishing** over zero-day exploitation: the group impersonates journalists, researchers, diplomats, and think-tank personnel in long-running correspondence campaigns to build trust before delivering malicious payloads or harvesting credentials. Its tooling ranges from commodity RATs (QuasarRAT, gh0st RAT) to a stable of bespoke malware families (BabyShark, AppleSeed, Gold Dragon, KONNI, Troll Stealer) and malicious browser extensions (TRANSLATEXT). Since 2023, Kimsuky has been observed leveraging commercial LLMs for target research and vulnerability analysis, and adopting ClickFix-style social engineering to trick victims into self-executing malicious PowerShell.

## Attribution & motivation

The rest: https://github.com/BitterSecurity/Decepticon/blob/HEAD/packages/decepticon/decepticon/skills/shared/adversary-emulation/kimsuky/SKILL.md