kimsuky-velvet-chollima

name	kimsuky-velvet-chollima
description	Adversary-emulation profile for Kimsuky (G0094 / Velvet Chollima / Emerald Sleet / THALLIUM / Black Banshee / APT43 / TA427), North Korea's RGB 63rd Research Center cyber-espionage actor.
allowed-tools	Bash Read Write
metadata	{"subdomain":"adversary-emulation","when_to_use":"Kimsuky, Velvet Chollima, Emerald Sleet, THALLIUM, Black Banshee, APT43, TA427, Springtail, Earth Kumiho, G0094, North Korean espionage emulation, BabyShark, AppleSeed, Gold Dragon, KONNI, FlowerPower, credential phishing think tanks/academia, social engineering journalist impersonation, malicious browser extensions, CHM/LNK-based execution, ClickFix social engineering, TRANSLATEXT, Troll Stealer, nuclear policy targeting, Korean Peninsula intelligence","tags":"kimsuky, velvet-chollima, emerald-sleet, thallium, black-banshee, apt43, ta427, springtail, north-korea, dprk, rgb, espionage, nation-state, g0094, adversary-emulation, mitre-attack","mitre_attack":"T1583, T1583.001, T1583.004, T1583.006, T1584.001, T1585, T1585.001, T1585.002, T1586.002, T1587, T1587.001, T1588.002, T1588.003, T1588.005, T1589.002, T1589.003, T1591, T1593.001, T1593.002, T1594, T1596, T1608.001, T1682, T1566, T1566.001, T1566.002, T1598, T1598.003, T1190, T1133, T1204.001, T1204.002, T1204.004, T1059.001, T1059.003, T1059.005, T1059.006, T1059.007, T1106, T1559.001, T1053.005, T1620, T1547.001, T1543.003, T1546.001, T1505.003, T1176.001, T1037.001, T1098.007, T1136.001, T1055, T1055.001, T1055.012, T1548.002, T1027, T1027.001, T1027.002, T1027.007, T1027.010, T1027.012, T1027.013, T1027.015, T1027.016, T1036.004, T1036.005, T1036.007, T1070.004, T1070.006, T1112, T1140, T1218.005, T1218.010, T1218.011, T1553.002, T1564.002, T1564.003, T1564.011, T1685, T1686, T1497.001, T1480.002, T1678, T1003.001, T1555.003, T1056.001, T1056.003, T1552.001, T1552.004, T1539, T1111, T1040, T1550.002, T1557, T1083, T1082, T1016, T1518.001, T1057, T1012, T1217, T1007, T1033, T1124, T1680, T1115, T1489, T1185, T1021.001, T1534, T1005, T1074.001, T1114.002, T1114.003, T1056.001, T1113, T1560.001, T1560.003, T1071.001, T1071.002, T1071.003, T1102.001, T1102.002, T1105, T1132.002, T1219.002, T1568, T1205, T1041, T1567.002, T1020, T1078.003, T1657, T1660, T1684.001, T1543.002, T1059.004, T1053.003, T1090.001"}

Kimsuky (Velvet Chollima, Emerald Sleet, THALLIUM, Black Banshee, APT43) — Adversary Emulation Profile

Kimsuky (MITRE ATT&CK G0094) is a DPRK-based cyber-espionage group attributed to North Korea's Reconnaissance General Bureau (RGB), specifically the 63rd Research Center, operating since at least 2012. Initially focused on South Korean government entities and think tanks, the group has expanded its aperture to the United States, Japan, Russia, and Europe — consistently targeting individuals and organizations with insight into Korean Peninsula foreign policy, nuclear policy, sanctions, and defense issues. Kimsuky is distinguished by its heavy investment in social engineering and credential phishing over zero-day exploitation: the group impersonates journalists, researchers, diplomats, and think-tank personnel in long-running correspondence campaigns to build trust before delivering malicious payloads or harvesting credentials. Its tooling ranges from commodity RATs (QuasarRAT, gh0st RAT) to a stable of bespoke malware families (BabyShark, AppleSeed, Gold Dragon, KONNI, Troll Stealer) and malicious browser extensions (TRANSLATEXT). Since 2023, Kimsuky has been observed leveraging commercial LLMs for target research and vulnerability analysis, and adopting ClickFix-style social engineering to trick victims into self-executing malicious PowerShell.

Attribution & motivation

• Sponsor / nation: Democratic People's Republic of Korea (DPRK) — Reconnaissance General Bureau (RGB), 63rd Research Center. U.S. government (CISA/FBI/CNMF joint advisory AA20-301A, 2020) and multiple vendor assessments (Mandiant/Google TAG, CrowdStrike, Microsoft, Symantec) attribute Kimsuky operations to North Korean state-sponsored actors. In 2023, the U.S. Treasury sanctioned Kimsuky as an entity of the RGB.
• Motivation: Primarily strategic intelligence collection (espionage) — gathering foreign policy, nuclear/defense, and sanctions intelligence for the DPRK regime. Secondary motivation includes financial theft (cryptocurrency theft and laundering to self-fund operations, per Mandiant's APT43 report) and limited influence operations (DMARC abuse for impersonation campaigns).
• Attribution confidence: High. Supported by U.S. government joint advisories (AA20-301A), FBI IC3 public service announcements (2026), Treasury OFAC sanctions designations, and consistent multi-vendor reporting (Mandiant, CrowdStrike, Microsoft, Symantec, Kaspersky, Malwarebytes, Cisco Talos, Proofpoint, Zscaler).

Targeting

• Sectors: Government and diplomatic bodies; think tanks and policy research institutes; academia (particularly Korean studies, nuclear policy, international relations); media and journalism; defense and military; international organizations (United Nations, IAEA); business services; manufacturing; cryptocurrency exchanges.