SectorA05
SectorA05 is a nation-state APT group with an espionage motive, tracked by Brandefense. It targets the Government, and Media and Entertainment sectors in South Korea. It uses 14 MITRE ATT&CK techniques.
- Techniques
- 14
- Exploited CVEs
- No CVE data
- First seen
- Jan 30, 2019
- Last seen
- Jan 30, 2019
- Record updated
Who They Target.
Sectors · 2
Countries · 1
How They Operate · MITRE ATT&CK.
14 techniques across 6 of 14 tacticsReconnaissance·
Resource Development·
Initial Access4
T1204.002
User Execution: Malicious File
User Execution: Malicious File
T1560.001
Archive Collected Data: Archive via Utility
Archive Collected Data: Archive via Utility
T1566.001
Phishing: Spearphishing Attachment
Phishing: Spearphishing Attachment
T1566.002
Phishing: Spearphishing Link
Phishing: Spearphishing Link
Execution3
T1055
Process Injection
Process Injection
T1059.005
Command and Scripting Interpreter: Visual Basic
Command and Scripting Interpreter: Visual Basic
T1140
Deobfuscate/Decode Files or Information
Deobfuscate/Decode Files or Information
Persistence1
T1547.001
Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
Privilege Escalation·
Defense Evasion3
T1036.007
Masquerading: Double File Extension
Masquerading: Double File Extension
T1102
Web Service
Web Service
T1552.001
Unsecured Credentials: Credentials In Files
Unsecured Credentials: Credentials In Files
Credential Access2
T1056.001
Input Capture: Keylogging
Input Capture: Keylogging
T1555.003
Credentials from Password Stores: Credentials from Web Browsers
Credentials from Password Stores: Credentials from Web Browsers
Discovery·
Lateral Movement·
Collection1
T1113
Screen Capture
Screen Capture
Command and Control·
Exfiltration·
Impact·
Arsenal · Malware And Tools.
- Freedom.dllmalware
Campaigns.
- Operation Kitty PhishingJan 2019
Indicators Of Compromise.
TLP:AMBER74 indicators on the Brandefense platform
IP, domain and hash indicators · YARA rules · ATT&CK Navigator export
Request A DemoAbout SectorA05.
A suspected nation-state advanced persistent threat group focused on collecting confidential South Korean intelligence while conducting targeted cryptocurrency theft.
Last updated Oct 19, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.