Kimsuky

Kimsuky is the only cluster documented here that is not trying to make money. Its product is correspondence, and its targets are the people who write about, negotiate with or advise governments on North Korea: think-tank researchers, academics, journalists, defectors and foreign-ministry staff.

The approach is patient: a first message asks for nothing, from an address impersonating a real journalist or academic. The payload comes later, usually as a webmail-lookalike credential page, since a mailbox password gives lasting access to a correspondence network.

Named individuals

None profiled on this site yet

Fabricated personas

None reconstructed under this tag

Indicators

1,944 in the searchable index

Hunts

None in the hunt library

How it differs from the other clusters here

Like the IT-worker cluster, Kimsuky builds rapport with a stranger under a fabricated identity, but the personas differ sharply.

IT-worker personas must survive hiring and employment, so are heavily documented; Kimsuky personas need only survive one exchange, so are thin and disposable.

Collection has no moment of theft to hunt for, unlike APT38: success is a mailbox that works normally while someone else also reads it.

Compare Lazarus GroupAPT38RGB (Reconnaissance General Bureau)Remote Worker Fraud / Contagious InterviewAndarielAPT37KonniMoonstone SleetPolinRider

What a defender would see

The observable is rarely malware but identity and mail configuration: forwarding rules, OAuth grants to unfamiliar applications, or app passwords nobody recognises.

A first-attempt sign-in from an unexpected location may follow a password typed into a lookalike login page days earlier.

Staff on Korean Peninsula policy should verify unsolicited, well-informed approaches from journalists or academics out of band before opening attachments or links.

Indicators

The 1,944 indicators the index holds under this cluster. The complete index is on Remote Workers.

Show more results

Where the evidence comes from

Show 50 more

Further reading

Published research on this cluster. None of it is this site’s work.

• North Korean Advanced Persistent Threat Focus: Kimsuky (AA20-301A) CISA, FBI and U.S. Cyber Command · 2020-10-27

  The baseline description of the cluster's targeting and technique set. Marked as archived and dated in its indicators, but the account of the social-engineering approach and the interest in mail configuration has held up.

• U.S., ROK Agencies Alert: DPRK Cyber Actors Impersonating Targets to Collect Intelligence NSA, FBI, U.S. Department of State and Republic of Korea agencies · 2023-06-01

  The joint advisory on impersonation of journalists and academics, and the one to hand to a think-tank or newsroom audience: it is written for the people being targeted rather than for their security team.

• Unraveling Sparkling Pisces's Tool Set: KLogEXE and FPSpy Unit 42 (Palo Alto Networks) · 2024-09-26

  Unit 42's own name for this cluster and the source for two malware families added to its arsenal since the CISA and NSA advisories above.