D
CyberSouth Korea

Higaisa

Suspected state-linked cyber threat groupTrackedPending verification
CyberKOR
Identification silhouette. Not drawn to scale between entries.
Fact cardConfidence · Source
System
TypeSuspected state-linked cyber threat group
ProliferationOrigin country only
Active since2009At least 2009Med[1]
MITRE ATT&CK IDG0126High[1]
Capabilities
ATT&CK techniques used28ATT&CK v20.1High[1]
Malware and toolscertutil, gh0st RAT, PlugX3 malware and tool entries linked in ATT&CKHigh[1]
Attribution and activity
Attributed sponsorSuspected South Korean originMed[1]
TargetsHigaisa has targeted government, public, and trade organizations in North Korea; however, they have also carried out attacks in China, Japan, Russia, Poland, and other nations.Med[1]
Notes
Higaisa is a threat group suspected to have South Korean origins. Higaisa has targeted government, public, and trade organizations in North Korea; however, they have also carried out attacks in China, Japan, Russia, Poland, and other nations. Higaisa was first disclosed in early 2019 but is assessed to have operated as early as 2009. Description adapted from MITRE ATT&CK®, © The MITRE Corporation, used under the ATT&CK Terms of Use.
Summary

Higaisa is a threat group suspected to have South Korean origins. Higaisa has targeted government, public, and trade organizations in North Korea; however, they have also carried out attacks in China, Japan, Russia, Poland, and other nations.

Draft entry. Values come from the cited public sources and are awaiting editor verification.
CompareJSON
Operators
South Korea
Sources
  1. Higaisa, Group G0126, MITRE ATT&CK
    Published/updated 2026-07-31 · Tier 2 · checked 2026-11-08
Change log
  • 2026-11-08 Entry created from MITRE ATT&CK Enterprise v20.1 (group G0126)