# Kimsuky North Korean APT global intelligence targeting

Published: 2025-06-20 · Severity: routine · Sectors: government-national, defense, financial-services, technology
Canonical: https://vorant.io/reports/b24685a9-7389-5937-abe3-ddced72ddbd4/kimsuky-north-korean-apt-global-intelligence-targeting

> Kimsuky APT conducts spearphishing and watering hole attacks to steal intelligence on Korean peninsula policy, nuclear programs, and sanctions.

This CISA/FBI/CNMF joint advisory profiles Kimsuky, a North Korean APT group operating since 2012 under the HIDDEN COBRA program. The group conducts global intelligence collection against South Korea, Japan, and the United States, focusing on foreign policy, national security, nuclear policy, and sanctions related to the Korean peninsula. Kimsuky primarily uses spearphishing with malicious attachments and social engineering to gain initial access, often impersonating reporters or posing as legitimate services to build trust before delivering malware. Once on target, the group deploys BabyShark malware—a VBS-based payload that establishes persistence via registry autostart, collects system information, and awaits C2 commands. Kimsuky employs well-known tools including modified TeamViewer for C&C, PowerShell for fileless execution, ProcDump for credential dumping, and custom keyloggers. The group disables Windows Firewall, abuses legitimate browser extensions for cookie/password theft, injects malicious code into explorer.exe, and exfiltrates data via email forwarding rules or RC4-encrypted channels. Targets include think tanks, foreign policy organizations, and cryptocurrency industry workers. No destructive activity has been observed; the intent is intelligence collection rather than network disruption.

## Mentioned in this report

- Threat actors: Kimsuky
- Malware: BabyShark, GREASE, MECHANICAL
- Campaigns: :STOLEN PENCIL

## Detection guidance (public sample)

### Mshta or Script Host Spawned by Office Application

ATT&CK: T1218.005

Office applications spawning mshta, wscript or cscript, consistent with spearphishing attachments delivering VBS/HTA payloads such as BabyShark. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Mshta or Script Host Spawned by Office Application
description: Detects Office processes launching mshta.exe, wscript.exe or cscript.exe,
  matching spearphishing attachment execution of VBS/HTA payloads like BabyShark.
tags:
- attack.execution
- attack.t1218.005
- attack.t1059.005
- attack.t1566.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
    - \WINWORD.EXE
    - \EXCEL.EXE
    - \POWERPNT.EXE
    Image|endswith:
    - \mshta.exe
    - \wscript.exe
    - \cscript.exe
  condition: selection
falsepositives:
- Legacy Office macros or add-ins that invoke VBScript helpers
- Line-of-business document templates launching scripts
level: high
id: 6852ebb3-4d5e-5709-987e-2e062dc5ad38
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa20-301a
```

### ProcDump Used to Dump LSASS Memory

ATT&CK: T1003

Detects procdump targeting lsass for credential dumping, a tool reported in Kimsuky operations. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: ProcDump Used to Dump LSASS Memory
description: Detects procdump or procdump64 invoked against lsass, matching Kimsuky
  use of ProcDump for credential dumping. Matches on the lsass argument and not on
  dump file names.
tags:
- attack.credential-access
- attack.t1003
- attack.t1003.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
  - Image|endswith:
    - \procdump.exe
    - \procdump64.exe
  - OriginalFileName: procdump
  selection_cli:
    CommandLine|contains:
    - lsass
  condition: selection_img and selection_cli
falsepositives:
- Administrators capturing LSASS dumps for crash troubleshooting with vendor support
level: high
id: ec67afa4-3e33-59d3-adad-4f69a34977f2
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa20-301a
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisa.gov/news-events/cybersecurity-advisories/aa20-301a

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/b24685a9-7389-5937-abe3-ddced72ddbd4/kimsuky-north-korean-apt-global-intelligence-targeting.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup