Kimsuky

Adversaries may buy, lease, rent, or obtain infrastructure that can be used during targeting. A wide variety of infrastructure exists for hosting and

An adversary may add additional local or domain groups to an adversary-controlled account to maintain persistent access to a system or domain. On Win

Adversaries may attempt to position themselves between two or more networked devices using an adversary-in-the-middle (AiTM) technique to support foll

An adversary may compress or encrypt data that is collected prior to exfiltration using a custom method. Adversaries may choose to use custom archival

Adversaries may use utilities to compress and/or encrypt collected data prior to exfiltration. Many utilities include functionalities to compress, enc

Adversaries may exfiltrate data, such as sensitive documents, through the use of automated processing after being gathered during Collection.(Citation

Adversaries may use an existing, legitimate external Web service as a means for sending commands to and receiving output from a compromised system ove

Adversaries may use binary padding to add junk data and change the on-disk representation of malware. This can be done without affecting the functiona

Adversaries may abuse internet browser extensions to establish persistent access to victim systems. Browser extensions or plugins are small programs t

Adversaries may enumerate information about browsers to learn more about compromised environments. Data saved by browsers (such as bookmarks, accounts

Adversaries may take advantage of security vulnerabilities and inherent functionality in browser software to change content, modify user-behaviors, an

Adversaries may establish persistence by executing malicious content triggered by a file type association. When a file is opened, the default program

Adversaries may collect data stored in the clipboard from users copying information within or between applications. For example, on Windows adversar

Adversaries may create, acquire, or steal code signing materials to sign their malware or tools. Code signing provides a level of authenticity on a bi

Adversaries may buy and/or steal code signing certificates that can be used during targeting. Code signing is the process of digitally signing executa

Adversaries may obfuscate content during command execution to impede detection. Command-line obfuscation is a method of making strings and patterns wi

Adversaries may use the Windows Component Object Model (COM) for local code execution. COM is an inter-process communication (IPC) component of the na

Adversaries may use compression to obfuscate their payloads or files. Compressed file formats such as ZIP, gzip, 7z, and RAR can compress and archive

Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials. These can be files created by use

Adversaries may acquire credentials from web browsers by reading files specific to the target browser. Web bro

Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to

Adversaries may use an existing, legitimate external Web service to host information that points to additional command and control (C2) infrastructure

Adversaries may employ various time-based methods to evade detection and analysis. These techniques often exploit system clocks, delays, or timing mec

Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They

Adversaries may build capabilities that can be used during targeting. Rather than purchasing, freely downloading, or stealing capabilities, adversarie

Adversaries may disable or modify host-based or network firewalls to impair defensive mechanisms and enable further action. Once an adversary has gath

Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detectio

Adversaries may hijack domains and/or subdomains that can be used during targeting. Domain registration hijacking is the act of changing the registrat

Adversaries may acquire domains that can be used during targeting. Domain names are the human readable names used to represent one or more IP addresse

Adversaries may abuse a double extension in the filename as a means of masquerading the true file type. A file name may include a secondary file type

Amadey is a Trojan bot that has been used since at least October 2018.(Cit

AppleSeed is a backdoor that has been used by Kimsuky to target So

BabyShark is a Microsoft Visual Basic (VB) script-based malware family that is believed to be associated wi

Brave Prince is a Korean-language implant that was first observed in the wild in December 2017. It contains

CSPY Downloader is a tool designed to evade analysis and download additional payloads used by [Kimsuky](htt

GoBear is a Go-based backdoor that abuses legitimate, stolen certificates for defense evasion purposes. [Go

Gold Dragon is a Korean-language, data gathering implant that was first observed in the wild in South Korea

Gomir is a Linux backdoor variant of the Go-based malware GoBear, uniquely assoicated with [Kimsuky](https:

HTTPTroy is a highly obfuscated backdoor that facilitates collection, command and control, defense evasion

KGH_SPY is a modular suite of tools used by Kimsuky for reconnaiss

Mimikatz is a credential dumper capable of obtaining plaintext Windows account logins and passwords, along

NOKKI is a modular remote access tool. The earliest observed attack using [NOKKI](https://attack.mitre.org/

PsExec is a free Microsoft tool that can be used to execute a program on another computer. It is used by IT

QuasarRAT is an open-source, remote access tool that has been publicly available on GitHub since at least 2

TRANSLATEXT is malware that is believed to be used by Kimsuky.(Cit

Troll Stealer is an information stealer written in Go associated with [Kimsuky](https://attack.mitre.org/gr

certutil is a command-line utility that can be used to obtain certificate authority information and configu

gh0st RAT is a remote access tool (RAT). The source code is public and it has been used by multiple groups.

schtasks is used to schedule execution of programs or scripts on a Windows system to run at a specific date