Kimsuky

THREAT ACTOR PROFILE

Kimsuky

Kimsuky is a North Korean state-sponsored espionage group active since at least 2012. It goes after South Korean government bodies, think tanks and the nuclear sector, and has widened its targeting to Japan, the US and Europe. Most of its recent campaigns start with a spear-phishing email carrying a shortcut file.

North Korea

Government / Private Sector

First seen

2012

Latest IOC

IP indicators

Hosts

SHA256 hashes

Posts

TABLE OF CONTENTS

Names and aliases

Group profile

Attack lifecycle

Malware and tooling

IOCs

Notable campaigns

NAMES AND ALIASES

Thirteen labels, including APT43 and Velvet Chollima

Few groups carry as many names as Kimsuky. Microsoft alone accounts for two of them (THALLIUM and Emerald Sleet), and Mandiant calls it APT43. Some entries are operation names rather than group names, like Netscout's Operation Stolen Pencil.

When a report mentions Black Banshee or Larva-24005, it belongs in the same hunt. We fold all of these into one record in our threat actors database, so IOCs from each vendor's write-up end up in the same place.

GROUP PROFILE

Espionage against Seoul's ministries, think tanks and universities

Kimsuky collects intelligence, not money. Its best-known operations include the 2015 theft of data from Korea Hydro & Nuclear Power and a 2020 campaign against UN officials.

Our records list the Ministry of Unification, the Sejong Institute and the Korea Institute for Defense Analyses among its targets. Recent posts add diplomatic missions, universities, military and security researchers, virtual asset companies and South Korean groupware vendors.

What changed in 2026 is the tooling around the phishing. Several reports show the group generating decoy documents with AI agents and running local LLMs, while the delivery chain itself stays close to what it has used for years.

Facts:

Initial Access

Russian Federation · GRU

Initial Access

Russian Federation · GRU

Initial Access

Russian Federation · GRU

Initial Access

Russian Federation · GRU

Victims reported in our records and posts:

ATTACK LIFECYCLE

LNK shortcuts that phone home through GitHub

The stages below come from 2025 and 2026 Kimsuky intrusions documented in posts we track on our IOC Hunter feed.

Initial Access

Spear-phishing remains the front door. In the 2026 campaign Hunt.io tracked as Operation Neusploit, APT28 sent convincing spear-phishing from already-compromised government accounts and abused a Microsoft Office security bypass (CVE-2026-21509) to kick off a fileless chain. A separate June 2026 cluster delivered the LameHug malware through spear-phishing ZIP archives using double-extension lures.

Initial Access

MALWARE AND TOOLING

AsyncRAT inside PNG files and a Gmail-stealing extension

Initial Access

CVES EXPLOITED

Kimsuky

IOCS FROM HUNT.IO PLATFORM

Latest IOCs

We currently track - IP indicators, - hosts, and - SHA256 hashes for Akira across - intelligence posts, with the most recent indicator dated -. The sample below is limited to indicators from the latest posts. It is not the full set.

Showing a sample of recent indicators

Get the complete

Kimsuky

IOC set, full IP, host and hash history.

Unlock all the IOCs for Free

Showing a sample of recent indicators

Get the complete

Kimsuky

IOC set, full IP, host and hash history.

Unlock all the IOCs for Free

NOTABLE CAMPAIGNS

How Kimsuky folded AI into its 2026 phishing

The group's 2026 activity keeps the same LNK and PowerShell chain while automating the lures and spreading C2 across more legitimate services.

PixyNetLoader tracking

A clustering of roughly 90 loader samples across four sub-families from 2024 to 2026, with steganography and cloud C2, also linking to related APT28 tooling such as SlimAgent and Graphite.

PixyNetLoader tracking

A clustering of roughly 90 loader samples across four sub-families from 2024 to 2026, with steganography and cloud C2, also linking to related APT28 tooling such as SlimAgent and Graphite.

PixyNetLoader tracking

A clustering of roughly 90 loader samples across four sub-families from 2024 to 2026, with steganography and cloud C2, also linking to related APT28 tooling such as SlimAgent and Graphite.

PixyNetLoader tracking

A clustering of roughly 90 loader samples across four sub-families from 2024 to 2026, with steganography and cloud C2, also linking to related APT28 tooling such as SlimAgent and Graphite.