Indicators of compromise · Kimsuky — 2 shown
inini[.]kesug[.]comhxxp://inini[.]kesug[.]com/uploads/payload[.]txt
Defanged third-party indicators (abuse.ch). The defanging is deliberate: never click, resolve or fetch these values. An indicator corroborates a report — it never proves one, and its presence here does not mean this story's hosts are listed.
Kimsuky — North Korea-Linked APT Group
Kimsuky (also tracked as APT43, Velvet Chollima, Emerald Sleet) is a North Korea-linked advanced persistent threat group known for cyber espionage operations targeting think tanks, academic institutions, and government entities — particularly those focused on朝鲜 affairs and foreign policy.
Recent Activity (2026)
As reported by The Record, Kimsuky breached South Korean software vendors in a supply-chain campaign (July 2026), targeting the software supply chain to reach downstream victims.
Building an offline AI stack (Aug 2026): South Korea's Genians reported that Kimsuky (under the Reconnaissance General Bureau) is running AI offline on its own servers, connecting document-search tools to files stolen in previous operations and assembling the software components needed to fold AI into its malware. Genians found no evidence of proprietary model training, but describes the group in a "research and knowledge acquisition" stage — applying AI to automate phishing development and malware writing. Confidence: probable (vendor analysis; intent inferred from infrastructure).(raw/digests/Cyber-Digest-2026-08-11.md)
Background
| Attribute | Detail |
|---|---|
| Aliases | APT43, Velvet Chollima, Emerald Sleet, Thallium |
| Attribution | Democratic People's Republic of Korea (DPRK) |
| Primary Focus | Cyber espionage — foreign policy,朝鲜 affairs, nuclear policy |
| Active Since | ~2012 |
Known TTPs
- Spear-phishing with malicious attachments and links
- Reconnaissance of academic and policy research networks
- Credential harvesting via custom malware and social engineering
- Supply chain compromise of software vendors to reach downstream targets (July 2026 campaign)
Related Pages
- Silver Fox — China-linked cybercrime group (different nation-state, similar targeting of software supply chain)
- Uat 7810 — China-linked APT targeting Taiwan critical infrastructure (regional state-sponsored context)