Threat actor profile
Kimsuky
A source-linked view of reported activity, targets and related automated campaign clusters.
Background and history
What we know about Kimsuky
Kimsuky is a North Korean state-linked espionage group focused on intelligence relevant to Korean Peninsula policy, foreign affairs, sanctions, defence and nuclear issues. It frequently targets government, research, media, academic and policy organisations through spearphishing and credential collection.
The group has been observed since at least 2012 and is tracked under several vendor-specific names. Campaigns often use topical documents, impersonation and carefully prepared lures tailored to specialists. This makes role-specific awareness and strong identity controls as important as conventional endpoint detection.
Known aliases
Kimsuky