NICKEL KIMBALL is a designation used by SecureWorks for a threat group assessed to have operated on behalf of the North Korean government since at least 2012. The group primarily targets non-governmental organizations, think tanks, diplomatic and military organizations, economic groups, and research entities involved with North Korean policy and relations, initially focusing on South Korean organizations before expanding internationally; it also seeks access to online accounts and networks used to track North Korean defectors and their relatives. NICKEL KIMBALL conducts extensive spearphishing operations using typosquatted or thematically relevant domains, combined with increasingly elaborate social engineering built from research into targets' social media presence and other public information. Its tooling is generally distinct from other North Korea-linked groups, historically relying on malicious Hangul Word Processor documents when targeting South Korean entities, and evolving to use more widely adopted Microsoft Word and PDF formats as its targeting expanded internationally; malware associated with the group's activity includes several custom remote access trojans and downloader tools.