{
  "id": "higaisa",
  "name": "Higaisa",
  "aliases": [],
  "domain": "cyber",
  "country": "KOR",
  "category": "Suspected state-linked cyber threat group",
  "status": "tracked",
  "fielded": null,
  "operators": [
    "KOR"
  ],
  "summary": "Higaisa is a threat group suspected to have South Korean origins. Higaisa has targeted government, public, and trade organizations in North Korea; however, they have also carried out attacks in China, Japan, Russia, Poland, and other nations.",
  "specs": [
    {
      "k": "sponsor",
      "v": "Suspected South Korean origin",
      "src": [
        "mitre-g0126"
      ],
      "conf": "medium"
    },
    {
      "k": "active_since",
      "v": 2009,
      "src": [
        "mitre-g0126"
      ],
      "conf": "medium",
      "note": "At least 2009"
    },
    {
      "k": "attack_id",
      "v": "G0126",
      "src": [
        "mitre-g0126"
      ],
      "conf": "high"
    },
    {
      "k": "targets",
      "v": "Higaisa has targeted government, public, and trade organizations in North Korea; however, they have also carried out attacks in China, Japan, Russia, Poland, and other nations.",
      "src": [
        "mitre-g0126"
      ],
      "conf": "medium"
    },
    {
      "k": "techniques_count",
      "v": 28,
      "src": [
        "mitre-g0126"
      ],
      "conf": "high",
      "note": "ATT&CK v20.1"
    },
    {
      "k": "software",
      "v": "certutil, gh0st RAT, PlugX",
      "src": [
        "mitre-g0126"
      ],
      "conf": "high",
      "note": "3 malware and tool entries linked in ATT&CK"
    }
  ],
  "payloads": [],
  "variants": [],
  "art": "cyber",
  "image": null,
  "verified": null,
  "notes": "Higaisa is a threat group suspected to have South Korean origins. Higaisa has targeted government, public, and trade organizations in North Korea; however, they have also carried out attacks in China, Japan, Russia, Poland, and other nations. Higaisa was first disclosed in early 2019 but is assessed to have operated as early as 2009. Description adapted from MITRE ATT&CK®, © The MITRE Corporation, used under the ATT&CK Terms of Use.",
  "changelog": [
    {
      "date": "2026-11-08",
      "change": "Entry created from MITRE ATT&CK Enterprise v20.1 (group G0126)"
    }
  ],
  "url": "https://www.defensepedia.com/systems/higaisa.html",
  "sources": {
    "mitre-g0126": {
      "title": "Higaisa, Group G0126",
      "publisher": "MITRE ATT&CK",
      "url": "https://attack.mitre.org/groups/G0126/",
      "published": "2026-07-31",
      "tier": 2,
      "checked": "2026-11-08"
    }
  }
}