Sun Team
Sun Team is a nation-state APT group with an espionage motive, tracked by Brandefense. It targets the Media and Entertainment, and Civil Society and NGOs sectors in South Korea. It uses 5 MITRE ATT&CK techniques.
- Techniques
- 5
- Exploited CVEs
- No CVE data
- First seen
- Jan 11, 2018
- Last seen
- Jan 11, 2018
- Record updated
Who They Target.
Countries · 1
How They Operate · MITRE ATT&CK.
5 techniques across 5 of 14 tacticsReconnaissance·
Resource Development·
Initial Access1
T1566.002
Phishing: Spearphishing Link
Phishing: Spearphishing Link
Execution1
T1105
Ingress Tool Transfer
Ingress Tool Transfer
Persistence·
Privilege Escalation·
Defense Evasion·
Credential Access1
T1056
Input Capture
Input Capture
Discovery·
Lateral Movement·
Collection1
T1123
Audio Capture
Audio Capture
Command and Control1
T1102.002
Web Service: Bidirectional Communication
Web Service: Bidirectional Communication
Exfiltration·
Impact·
About Sun Team.
A threat group active since at least 2016, exhibiting North Korean linguistic artifacts and targeting North Korean defectors, journalists, and associated support organizations.
Last updated Oct 19, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.