Kimsuky
Kimsuky is a South Korea-attributed nation-state APT group with an ideological motive, tracked by Brandefense. It targets 18 sectors, including Government and Technology, in 48 countries, including the United States and the United Kingdom. It uses 267 MITRE ATT&CK techniques and exploits 23 known CVEs.
Also known as
- Black Banshee
- Velvet Chollima
- Emerald Sleet
- THALLIUM
- APT43
- TA427
- Earth Kumiho
- PatheticSlug
- Origin
- South Korea
- Techniques
- 267
- Exploited CVEs
- 23
- First seen
- Mar 6, 2024
- Last seen
- Dec 22, 2025
- Record updated
Who They Target.
Sectors · 18
Countries · 48
Labelsactive-2026credential-theftdmarc-abuseespionagekorean-peninsulanorth-korea-nexusquishingrgb-linkedsocial-engineeringspearphishing
About Kimsuky.
North Korean state-sponsored threat group known for diverse attack methodologies including exploiting vulnerabilities, supply-chain attacks, and social engineering, now employing 'quishing' for MFA bypass.
Last updated Oct 14, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.