KimsukyThreat actor

“APT-C-55 (Kimsuky): Chinese security firm Qihoo360 looks at a major Kimsuky spear-phishing operation using lures in Korean, Japanese, Vietnamese, German, and English.”

“Famous Chollima, Kimsuky, and Konni primarily targeted developers and IT professionals.”

“Kimsuky linked to two ransomware strains: Security firm AhnLab has linked the North Korean hacking group Kimsuky to two ransomware strains named Endpoint and Funhouse.”

“Kimsuky's Operation GitPower targets Ukraine: North Korean APT group Kimsuky is targeting Ukrainian experts in diplomacy, security, and international policy with targeted spear-phishing operations.”

“AhnLab SEcurity intelligence Center (ASEC) recently identified a case in which the Kimsuky group ultimately distributed the Funhouse ransomware via a malicious Hangul document that was disguised as a resume.”

“AutoIT backdoor Decoy 미끼문서 백도어 바로가기 GitHub HTA HWP 피싱 한글문서 Keylogger Kimsuky LNK mshta Phishing PowerShell Python RAT SpearPhishing”

“Kimsuky Conducts Git-Based C2 Attacks — In more North Korea-related malicious activity, the Kimsuky group has resorted to conducting Git-based C2 attacks through malicious LNK files contained within ZIP archives.”

“Konni is assessed to be a subgroup of the broader Kimsuky umbrella.”

“Kimsuky used generative AI-based decoy documents and Git-based C2, and there were also indications of the use of local LLM and AI technologies.”

“Kimsuky adopts AI: North Korean APT group has used the Opencode AI agent to create decoy PDF files while its malicious code connects to GitHub to retrieve and run malicious PowerShell code.”

“Either surface represents a plausible initial access vector consistent with documented Kimsuky tradecraft.”

“Let’s examine the tactics used by a malicious LNK file linked to Kimsuky, which disguises the attack by masquerading as a legitimate business document.”

“…ion to the 3rd and/or the 5th Bureau is debated among the CTI community, they are the inheritage of the historical Lazarus umbrella and Kimsuky cluster.”

“APT AutoIT backdoor Decoy 미끼문서 백도어 바로가기 GitHub HTA 피싱 Keylogger Kimsuky LNK mshta Phishing PowerShell Python RAT SpearPhishing”

“Kimsuky used Gomir, BirdTroy, and DriveTroy to spread the infection across groupware developers and their clients.”

“Un aviso del FBI publicado en enero de 2026 advirtió que el grupo norcoreano Kimsuky había atacado centros de investigación, instituciones académicas y organismos gubernamentales de Estados Unidos y otros países mediante correos de spearphishing…”

“Researchers outlined how North Korea-linked Kimsuky is building an offline AI environment to support phishing, intelligence analysis, and malware development.”

“An FBI notice from January 2026 warned that the North Korean Kimsuky outfit targeted think tanks, academic institutions, and US/foreign government entities with embedded QR codes in spearphishing emails.”

“…tiveDevelopment continuaron invirtiendo en la construcción de relaciones a largo plazo con objetivos de alto valor, mientras que Kimsuky y Konni favorecieron ataques más rápidos y oportunistas.”

“Lazarus and DeceptiveDevelopment continued to invest in long-term relationship building with high-value targets, while Kimsuky and Konni favored quicker, more opportunistic attacks.”