Geumseong121
Geumseong121 is a North Korea-attributed nation-state APT group with an espionage motive, tracked by Brandefense. It targets the Government, and Defense and Aerospace sectors in South Korea. It uses 10 MITRE ATT&CK techniques.
Also known as
- Guemseong 121
- Origin
- North Korea
- Techniques
- 10
- Exploited CVEs
- No CVE data
- First seen
- Mar 30, 2020
- Last seen
- Mar 30, 2020
- Record updated
Who They Target.
Sectors · 2
Countries · 1
How They Operate · MITRE ATT&CK.
10 techniques across 8 of 14 tacticsResource Development·
Execution1
T1059.005
Command and Scripting Interpreter: Visual Basic
Command and Scripting Interpreter: Visual Basic
Persistence1
T1112
Modify Registry
Modify Registry
Privilege Escalation·
Defense Evasion1
T1027
Obfuscated Files or Information
Obfuscated Files or Information
Credential Access·
Discovery1
T1518.001
Software Discovery: Security Software Discovery
Software Discovery: Security Software Discovery
Lateral Movement·
Collection·
Command and Control1
T1102.002
Web Service: Bidirectional Communication
Web Service: Bidirectional Communication
Exfiltration1
T1567.002
Exfiltration Over Web Service: Exfiltration to Cloud Storage
Exfiltration Over Web Service: Exfiltration to Cloud Storage
Impact·
Campaigns.
- Operation Spy CloudMar 2020
About Geumseong121.
A North Korean state-sponsored cyber espionage group active against South Korean government agencies, foreign affairs officials, defector groups, and unification specialists.
Last updated Oct 19, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.