D
CyberNorth Korea

Kimsuky

State-sponsored cyber threat groupActivePending verification

Also known as: APT43, Velvet Chollima, Emerald Sleet, THALLIUM, Black Banshee

CyberPRK
Identification silhouette. Not drawn to scale between entries.
Fact cardConfidence · Source
System
TypeState-sponsored cyber threat group
Alternative designationsAPT43, Velvet Chollima, Emerald Sleet, THALLIUM, Black Banshee
ProliferationOrigin country only
Active since2012At least 2012Med[1]
MITRE ATT&CK IDG0094High[1]
Attribution and activity
Attributed sponsorDemocratic People's Republic of Korea (DPRK)Med[1]
TargetsSouth Korean government agencies and think tanks, the United Nations, organizations in the U.S., Japan, Russia and EuropeMed[1]
Notable activityOperation STOLEN PENCIL (2018); Operation Kabar Cobra (2019); Operation Smoke Screen (2019)Med[1]
Summary

DPRK-based cyber espionage group collecting on foreign policy and national security issues tied to the Korean Peninsula, nuclear policy and sanctions. Since 2023 it has used commercial large language models to support reconnaissance and social engineering.

Draft entry. Values come from the cited public sources and are awaiting editor verification.
CompareJSON
Operators
North Korea
Sources
  1. Kimsuky, Group G0094, MITRE ATT&CK
    Published/updated 2026-07-31 · Tier 2 · checked 2026-10-05
Change log
  • 2026-10-05 Entry created from MITRE ATT&CK (group page version 5.2)