ATT&CK ReferencesKimsuky Malwarebytes

Kimsuky Malwarebytes

Hossein Jazi. (2021, June 1). Kimsuky APT continues to target South Korean government using AppleSeed backdoor. Retrieved January 10, 2024.

Techniques0

Not cited by any technique.

None recorded.

None recorded.

None recorded.

Technique	Used by	Procedure example
T1036.005 Match Legitimate Resource Name or Location	GroupKimsuky	Kimsuky has renamed malware to legitimate names such as `ESTCommon.dll` or `patch.dll`. Kimsuky has also disguised payloads using legitimate file names including a PowerShell payload named chrome.ps1. Kimsuky has also used a malicious QR code that masqueraded as a legitimate package delivery service. EnkiWhiteHat_KimsukyDOCSWAP_Dec2025 Kimsuky Malwarebytes Securonix Kimsuky February 2025

Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.