DPRK Cyber IndexYearsActorsSourcesAttacks on North KoreaMethodologyContributeSearch

Operation“Kimsuky”

Date (as written)
01.01.2013
Year
2013
Country
Korea, Republic of;Korea, Republic of;Korea, Republic of;Korea, Republic of;China;China;China;China
Actors (as written)
Kimsuky/Velvet Chollima/STOLEN PENCIL/Emerald Sleet fka THALLIUM/Black Banshee/G0094
Actor pages
KimsukyVelvet ChollimaSTOLEN PENCILEmerald Sleet fka THALLIUMBlack BansheeG0094
Tags (as written)
Data theft;Hijacking with Misuse

Source entries (6)

EuRepoC

Operation“Kimsuky” · 01.01.2013
The Kimsuky cyberespionage campaign appears to be originated in NorthKorea and hit numerous organizations, eleven of which located in the South Korea and two in China. The attackers infected victims with a malware able to remote controls the PC, loggingkey strokes, stealing HWP documents.
https://securelist.com/the-kimsuky-operation-a-north-korean-apt/57915/
https://securityaffairs.com/169162/apt/kimsuky-apt-hit-diehl-defence.html

ThaiCERT Threat Group Cards

For several months, we have been monitoring an ongoing cyber-espionage campaign against South Korean think-tanks. · 2013
For several months, we have been monitoring an ongoing cyber-espionage campaign against South Korean think-tanks. https://securelist.com/the-kimsuky-operation-a-north-korean-apt/57915/
https://securelist.com/the-kimsuky-operation-a-north-korean-apt/57915/

CFR Cyber Operations Tracker

Kimsuky · Oct 2013
This threat actor targeted foreign ministries and think tanks in Europe and the United States using malware hidden in Microsoft Word documents and antiquated file formats.
https://www.cfr.org/cyber-operations/kimsuky
https://blog.prevailion.com/2019/09/autumn-aperture-report.html

Hackmageddon cyber attacks timelines (Paolo Passeri)

(target column shows South Korean flag icon) · 11-Sep
Kaspersky Lab discloses the details of the "Kimsuky" Operation. A massive cyber-espionage campaign from North Korea against South Korea [transcribed from timeline image]
https://www.hackmageddon.com/2013/09/20/1-15-september-2013-cyber-attacks-timeline/
https://www.hackmageddon.com/wp-content/uploads/2013/09/1-15-september-2013-cyber-attacks-timeline.png

Kaspersky Securelist

Kimsuky APT: Operation’s possible North Korean links uncovered · 2013-09-11T23:35:27
For several months, we have been monitoring an ongoing cyber-espionage campaign against South Korean think tanks. There are multiple reasons why this campaign is extraordinary in its execution and logistics. It all started one day when we encountered a somewhat unsophisticated spy program that communicated with its “master” via a public e-mail server. This approach
https://securelist.com/kimsuky-apt-operations-possible-north-korean-links-uncovered/57335/

Kaspersky Securelist

The “Kimsuky” Operation: A North Korean APT? · 2013-09-11T20:10:42
For several months, we have been monitoring an ongoing cyber-espionage campaign against South Korean think-tanks. There are multiple reasons why this campaign is extraordinary in its execution and logistics. It all started one day when we encountered a somewhat unsophisticated spy program that communicated with its “master” via a public e-mail server. This approach is
https://securelist.com/the-kimsuky-operation-a-north-korean-apt/57915/

Suggest a correction on GitHub