KingSqlZ
KingSqlZ is a nation-state APT group with an espionage motive, tracked by Brandefense. It targets the Government, and Energy and Utilities sectors. It uses 18 MITRE ATT&CK techniques.
- Techniques
- 18
- Exploited CVEs
- No CVE data
- First seen
- May 18, 2019
- Last seen
- May 18, 2019
- Record updated
Who They Target.
Sectors · 2
How They Operate · MITRE ATT&CK.
18 techniques across 9 of 14 tacticsReconnaissance1
T1497
Virtualization/Sandbox Evasion
Virtualization/Sandbox Evasion
Resource Development·
Initial Access3
T1021.001
Remote Services: Remote Desktop Protocol
Remote Services: Remote Desktop Protocol
T1204.002
User Execution: Malicious File
User Execution: Malicious File
T1566.001
Phishing: Spearphishing Attachment
Phishing: Spearphishing Attachment
Execution4
T1053.005
Scheduled Task/Job: Scheduled Task
Scheduled Task/Job: Scheduled Task
T1055.012
Process Injection: Process Hollowing
Process Injection: Process Hollowing
T1059.001
Command and Scripting Interpreter: PowerShell
Command and Scripting Interpreter: PowerShell
T1059.005
Command and Scripting Interpreter: Visual Basic
Command and Scripting Interpreter: Visual Basic
Persistence1
T1547.009
Boot or Logon Autostart Execution: Shortcut Modification
Boot or Logon Autostart Execution: Shortcut Modification
Privilege Escalation2
T1134
Access Token Manipulation
Access Token Manipulation
T1548.002
Abuse Elevation Control Mechanism: Bypass User Account Control
Abuse Elevation Control Mechanism: Bypass User Account Control
Defense Evasion2
T1027
Obfuscated Files or Information
Obfuscated Files or Information
T1573.001
Encrypted Channel: Symmetric Cryptography
Encrypted Channel: Symmetric Cryptography
Credential Access3
T1056.001
Input Capture: Keylogging
Input Capture: Keylogging
T1555
Credentials from Password Stores
Credentials from Password Stores
T1555.003
Credentials from Password Stores: Credentials from Web Browsers
Credentials from Password Stores: Credentials from Web Browsers
Discovery1
T1125
Video Capture
Video Capture
Lateral Movement·
Collection·
Command and Control1
T1568.002
Dynamic Resolution: Domain Generation Algorithms
Dynamic Resolution: Domain Generation Algorithms
Exfiltration·
Impact·
Arsenal · Malware And Tools.
- WarzoneRATmalware
- rdpwraptool
- Remcostool
Campaigns.
- Operation Black LionMay 2019
Indicators Of Compromise.
TLP:AMBER11 indicators on the Brandefense platform
IP, domain and hash indicators · YARA rules · ATT&CK Navigator export
Request A DemoAbout KingSqlZ.
A Turkish nationalist threat actor group known for large-scale web server compromises and defacements that resurfaced in 2019 executing targeted attacks using commercial malware.
Last updated Oct 19, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.