← All Threat Actors / Kimsuky
Last updated: April 02, 2026
K
Kimsuky
North Korean Reconnaissance General Bureau (RGB), 63rd Research Center
🇰🇵 North KoreaNation-State● ActiveG0094
Key Intelligence
MITRE ID
G0094
Country
🇰🇵 North Korea
Motivation
Espionage, Intelligence Collection
Active Since
2012
Last Seen
2025
Techniques
25 across 11 tactics
Attribution
North Korean Reconnaissance General Bureau (RGB), 63rd Research Center
Also Known As
Velvet ChollimaThalliumEmerald SleetBlack BansheeAPT43TA406Sparkling PiscesARCHIPELAGO
Target Profile
Targeted Industries
Think TanksAcademiaGovernmentJournalismDiplomacyNuclear Research
Targeted Countries
🇰🇷 South Korea🇺🇸 United States🇯🇵 Japan🇪🇺 European Union

Overview

Kimsuky is a North Korean espionage group focused on intelligence collection supporting DPRK nuclear and geopolitical interests. Specializes in highly targeted social engineering against think tanks, academics, diplomats, and journalists covering Korean Peninsula affairs. Known for extensive use of credential phishing, reconnaissance operations, and deploying custom malware for long-term intelligence gathering.

Tools & Malware

BabySharkAppleSeedFlowerPowerGoldDragonRandomQueryReconSharkFastViewerSHARPEXTBabyShark AnalysisGoPhish

Malware & Tool Details

Arsenal attributed to Kimsuky.

BabyShark
VBS Backdoor
VBS Backdoor
AppleSeed
Backdoor
Backdoor
FlowerPower
PowerShell Backdoor
PowerShell Backdoor
GoldDragon
Multi-Stage Backdoor
Multi-Stage Backdoor
RandomQuery
Malware / Tool
ATT&CK Software
ReconShark
Reconnaissance Tool
Reconnaissance Tool
FastViewer
Malware / Tool
ATT&CK Software
SHARPEXT
Browser Extension
Browser Extension
BabyShark Analysis
Reconnaissance Backdoor
Reconnaissance Backdoor
GoPhish
Phishing Framework
Phishing Framework

Attack Path ReconShark / SHARPEXT (2023-2024)

Following MITRE ATT&CK Flow methodology.

ATTACK FLOWReconShark / SHARPEXT (2023-2024)8 steps | Drag nodes to rearrange

Diamond Model

Caltagirone, Pendergast & Betz (2013) | Drag to rearrange
ADVERSARY
RGB 63rd Research Center, operators posing as academics
CAPABILITY
BabyShark, AppleSeed, ReconShark, SHARPEXT, FlowerPower, GoldDragon, FastViewer
INFRASTRUCTURE
Compromised university websites, free hosting, Google/Dropbox for C2
VICTIM
Think tanks (CSIS, Stimson), academics, journalists, diplomats on Korea policy

ATT&CK Navigator

Interactive MITRE ATT&CK Navigator layer for Kimsuky (G0094).

Open Full Navigator

Known CVEs Exploited

CVEYearDescription
CVE-2021-404442021MSHTML RCE in document attacks on South Korean targets
CVE-2022-411282022Windows Scripting RCE via IE in phishing

Notable Campaigns

2024
SHARPEXT Browser Extension
Deployment of malicious browser extension to steal email from Chrome/Edge.
2023
ReconShark Campaign
Spearphishing campaign targeting North Korea policy experts.
2019
KISA Alert Campaign
Targeting of journalists and diplomats covering DPRK.
2014
Korea Hydro Nuclear Power Breach
Infiltration of South Korean nuclear power operator.

Detection Engineering

Unauthorized Browser Extension Detection
Monitor Chrome/Edge extension installations via registry (HKCU\Software\Google\Chrome\Extensions). Alert on sideloaded extensions not from official Web Store. Detect modifications to browser Preferences and Secure Preferences files that bypass extension verification.
View Detection Rule / Guide
Credential Phishing Infrastructure
Deploy URL filtering to block newly registered domains (<30 days old) mimicking login portals. Monitor for certificate transparency logs registering domains similar to organizational login pages. Alert on HTML attachments with credential harvesting forms.
View Detection Rule / Guide
Cloud C2 via Google Drive/Dropbox
Monitor for unusual file upload/download patterns to cloud storage from endpoints. Detect OAuth token grants to unfamiliar third-party applications. Alert on API calls to Google Drive/Dropbox from processes other than official clients.
View Detection Rule / Guide

Related Threat Actors

Documented in MITRE ATT&CK, vendor intelligence, and government advisories.

Lazarus Group
Same nation (DPRK)
Both RGB but different missions.
APT37
DPRK co-operator
ScarCruft/Reaper — overlapping South Korea targeting.

Defense Recommendations

Mitigations with MITRE ATT&CK IDs. Click badges for implementation guidance.

Deploy FIDO2/WebAuthn phishing-resistant MFA. Kimsuky's primary vector is credential phishing via cloned portals.
CISA AA20-301A
Manage browser extensions via GPO. Allow only approved extensions. Kimsuky deploys SHARPEXT to read Gmail silently.
Volexity SHARPEXT
Monitor email forwarding rules for unauthorized external forwarding. Kimsuky creates silent forwarding rules.
Microsoft EOP Guide

Attribution Confidence

High
Attribution
Confidence
Evidence Supporting Attribution
CISA/FBI/CNMF joint Kimsuky advisory (2020)
https://www.cisa.gov/news-events/cybersecurity-advisories/aa
South Korean NIS attribution to RGB 63rd Research Center
https://attack.mitre.org/groups/G0094/
Multiple vendor attributions (AhnLab, SentinelOne, Rapid7)
https://asec.ahnlab.com/en/57873/

Threat Assessment

Capability6/10
Intent8/10
Targeting6/10
Moderate
Overall Threat Level
Prolific but less technically sophisticated than Lazarus. Relies heavily on social engineering. Primary mission is intelligence collection on DPRK policy.

Legal Actions & Sanctions

No documented legal actions.

Recent Reporting

2024-03
Rapid7: Kimsuky social engineering targeting researchers
https://www.rapid7.com/blog/post/2024/03/14/social-engineering-by-dprk/

Emulation Plans & Guidance

PlanSourceTypeDescriptionLink
CISA AA20-301A Kimsuky AdvisoryCISAGuideComprehensive advisory with TTPs, IOCs, and mitigation guidanceOpen
Volexity SHARPEXT AnalysisVolexityGuideTechnical analysis of SHARPEXT Chrome extension with detection methodsOpen
SentinelOne: ReconShark Deep DiveSentinelOneGuideTechnical analysis of ReconShark with detection rules and emulation guidanceOpen
Emulating Kimsuky's Espionage OperationsAttackIQBlog PostEmulation of Kimsuky credential phishing, browser extension deployment, and intelligence collectionOpen
Combatting Kimsuky and Safeguarding National IntelligenceAttackIQBlog PostIn-depth emulation of Kimsuky behaviors with CISA AA20-301A response scenariosOpen

References & Intelligence Sources

Page Contributors

Adversary Village
MITRE ATT&CK Team
BreachSimRange