G0094

2019-08-26 • MITRE • Kimsuky

G0094 is the MITRE ATT&CK group identifier for Kimsuky and related tracking names including Black Banshee, Velvet Chollima, Emerald Sleet, THALLIUM, APT43, TA427, Springtail, Earth Kumiho, and PatheticSlug. ATT&CK records spoofed domains, purchased hosting, payload hosting on web services, HTTP and FTP command channels, and archiving and encrypting collected data before exfiltration.

Related Actors

Related Reports in This Cluster

Top Authors

View G0094 reports only

2026-10-21
Nextron Systems
#Kimsuky #LNK
2026-10-16
Ahnlab
#FamousChollima #ContagiousInterview #OtterCookie #PolinRider #Kimsuky #Konni #VelvetCake
2026-10-16
Ahnlab
#FamousChollima #ContagiousInterview #OtterCookie #PolinRider #Kimsuky #Konni #VelvetCake
2026-10-15
Qihoo360
#Phishing #GitHub #APT-C-55 #LNK
2026-10-12
Ahnlab
#Kimsuky #Funhouse #Endpoint #QuasarRAT #Ransomware #Hangul
2026-10-12
Ahnlab
#Kimsuky #Ransomware #QuasarRAT #Hangul #Funhouse #Endpoint
2026-10-11
Genians
#Kimsuky #GitPower #Phishing #GitHub #LNK
2026-10-11
Genians
#Kimsuky #GitPower #GitHub #Phishing #LNK
2026-09-30
Ahnlab
#Kimsuky #Phishing #LNK #AutoIt #GitHub #PubNub #XenoRAT #Hangul #T1059.001 #T1053.005 #T1574.002 #T1566.001
2026-09-30
Ahnlab
#Kimsuky #AutoIt #GitHub #Hangul #LNK #Phishing #PubNub #T1053.005 #T1059.001 #T1566.001 #T1574.002 #XenoRAT
2026-09-18
Ahnlab
#FamousChollima #PolinRider #JasperSleet #Kimsuky #Lazarus #DreamJob #CVE-2026-68820 #Trend
2026-09-18
Ahnlab
#FamousChollima #JasperSleet #Kimsuky #Lazarus #DreamJob #CVE-2026-68820 #PolinRider #Trend
2026-09-16
Hive Pro
#Kimsuky #Espionage #Phishing #GitPower #KabarCobra #AppleSeed #PebbleDash #Windows #Android #GitHub #CVE-2017-11882 #CVE-2018-0802 #CVE-2019-0708 #CVE-2024-1709 #T1566.001 #T1566.002 #T1204.002 #T1059.001 #T1053.005 #T1497.001 #T1070.003 #T1056.001 #T1555.003 #T1003.001 #T1113 #T1115 #T1219 #T1567.002
2026-09-10
Qihoo360
#LNK #LOTL #APT-C-55
2026-09-09
ESTSecurity
#Kimsuky #LNK #GitHub #LOTL #T1053.005 #T1057 #T1082 #T1083 #T1087.001 #T1105 #T1140 #T1204.002 #T1567.002 #T1016

View G0094 reports only