Kimsuky Threat Actor Profile: Spear Phishing, Impersonation and Defences

Kimsuky is a North Korean espionage group that steals intelligence by impersonating people its targets already trust, then harvesting their mailboxes, passwords and sessions. Its targets are policy analysts, academics, journalists, diplomats, defence staff and the organisations around them, and its main weapon is a patient, well-researched email conversation rather than a software exploit. This profile covers the group's names and aliases, its targeting, the techniques MITRE ATT&CK and joint US and Republic of Korea (ROK) advisories attribute to it, recent 2025 activity, and the controls that blunt it. It is written for security teams at think tanks, universities, media outlets, government bodies and defence suppliers, and for anyone who protects high-profile individuals. It describes behaviour for defenders and contains no attacker tooling steps.

Key takeaways

• Intelligence is the goal. Joint advisories from the NSA, FBI, US State Department and ROK agencies say Kimsuky collects information on foreign policy, security and the Korean Peninsula for North Korea's Reconnaissance General Bureau (RGB).
• Impersonation does the heavy lifting. The group poses as journalists, academics and officials, and uses accounts it has already compromised to make the next lure more credible.
• Weak DMARC helps them. The May 2024 FBI, State and NSA advisory showed Kimsuky sending spoofed mail that reached inboxes because the impersonated domains had DMARC set to p=none or no policy at all.
• The playbook keeps adapting. In 2025 researchers reported "ClickFix" lures that persuade victims to paste PowerShell commands, and a ChatGPT-generated fake military ID used against a South Korean defence body.
• Identity controls are the main defence: phishing-resistant MFA, strict DMARC, mailbox rule monitoring, browser extension control and out-of-band verification for unexpected requests.

Who they are (names and aliases)

MITRE ATT&CK (G0094) describes Kimsuky as a North Korea-based cyber espionage group active since at least 2012, and notes that its operations overlap with other North Korean actors through ad hoc collaboration and limited resource sharing. The May 2024 advisory states that Kimsuky is administratively subordinate to the 63rd Research Center within the RGB. CISA advisory AA20-301A (October 2020) said the group had most likely been operating since 2012.

Vendor clusters are not perfectly aligned, so a report on "APT43" may include activity another vendor would not label Kimsuky. See the Threat Actor Groups Guide.

Targeting and motivation

• Policy expertise: the 1 June 2023 joint advisory names think tanks, academia and news media, and individuals with knowledge of geopolitical events, foreign policy and security developments affecting the Korean Peninsula.
• Government and defence: ATT&CK records initial targeting of South Korean government agencies and expansion to the United Nations and to government, education, business services and manufacturing organisations in the United States, Japan, Russia and Europe. The 2024 advisory adds cleared personnel and military members.
• Critical infrastructure: ATT&CK states Kimsuky was assessed to be responsible for the 2014 compromise of Korea Hydro & Nuclear Power Co.
• Self-funding: Mandiant's March 2023 APT43 report says the group steals and launders enough cryptocurrency to buy operational infrastructure, and in July 2023 Mandiant observed APT43 targeting executives at fintech and cryptocurrency firms in the US, South Korea, Hong Kong and Singapore. ATT&CK lists Financial Theft (T1657) against G0094.

The common thread is people with access to information, not systems with valuable data. That makes personal accounts, home devices and mailboxes of staff as important as corporate infrastructure.

Tactics and techniques (MITRE ATT&CK)

ATT&CK v20 links Kimsuky to around 130 techniques. The selection below focuses on social engineering, credential theft and mailbox access. All IDs were checked against ATT&CK v20 and are listed for G0094.

How they abuse identities and credentials

Kimsuky's operations are, in practice, an identity attack chain. Each step either borrows a trusted identity or steals one.

1. Borrow a trusted name: the 2024 advisory describes an email that passed SPF and DKIM because it came from a compromised university account, and another that spoofed a journalist's domain that had no DMARC policy. In both cases the Reply-To header sent replies to an actor-controlled mailbox. See the DMARC, SPF and DKIM Guide.
2. Build rapport before the payload: red flags in the advisory include an innocuous first message followed by links or documents, sometimes from a different address, text reused from the victim's real conversations, and follow-ups within two to three days.
3. Harvest credentials and sessions: AA20-301A records login-security-alert phishing, a 2018 Chrome extension that stole passwords and cookies, keyloggers, and a modified PHProxy that collected credentials typed into websites. See the Browser Extension Security Guide and the Session Hijacking and Cookie Theft Guide.
4. Persist in the mailbox: ATT&CK lists email forwarding rules and remote email collection, which keep intelligence flowing even after a password reset if rules and tokens are not cleared.
5. Reuse the victim as a lure: the 2023 joint advisory says Kimsuky uses information from compromised targets to craft more credible spear phishing against others.

Because many targets are individual experts, personal webmail and personal devices are part of the attack surface. Organisations that support external fellows, advisers or journalists should extend guidance and, where possible, protections to them. See the Executive and VIP Device Protection Guide.

Notable incidents

The deepfake ID case shows how generative AI lowers the cost of convincing forgeries. See the Deepfake and AI Impersonation Guide.

Detection and defence

Controls mapped to behaviours

Phased rollout

1. Week 1 to 4: identify staff and associates whose expertise matches Kimsuky targeting. Brief them on the red flags in the May 2024 advisory and give them a single, easy reporting route.
2. Month 2: move your own domains from p=none to p=quarantine after reviewing aggregate reports, then to p=reject. Keep the previous record ready to restore if legitimate senders break.
3. Month 3: enrol high-risk users in phishing-resistant MFA, starting with email and document storage. Pilot with a small group, then require it.
4. Ongoing: enforce extension allowlists, block external auto-forwarding, and test with simulated rapport-based phishing rather than one-shot lures.

What to monitor

• New inbox rules and forwarding: especially rules that move or forward mail containing policy keywords.
• Sign-ins after a reported lure: new devices, new countries and token refreshes for the targeted user.
• PowerShell launched by a user from a browser instruction: interactive PowerShell as administrator on a non-IT workstation, followed by remote desktop software installation.
• DMARC aggregate reports: spoofing attempts against your domain, which may mean partners are being targeted in your name.

Metrics

• Percentage of owned domains at p=reject.
• Percentage of high-risk users on phishing-resistant MFA.
• Median time from a user report to mailbox and session review.
• Number of external forwarding rules detected and removed per quarter.
• Reporting rate in rapport-based phishing simulations.

Small organisations such as think tanks often rely on a hosted email suite: strict DMARC, security keys for key staff and disabling external forwarding cover most of the risk at low cost. Large government and defence organisations should add dedicated threat hunting on mailbox and identity logs and coordinate with national CERTs. Report suspected targeting to IC3 with #KimsukyCSA in the description, as both joint advisories request.

Common failure patterns

• Leaving DMARC at p=none indefinitely: monitoring mode is useful for a few weeks, but the 2024 advisory shows it lets impersonators reach inboxes.
• Resetting the password but not the mailbox: forwarding rules, app passwords and live sessions survive a reset unless explicitly removed.
• Trusting a known sender address: compromised academic and partner accounts pass SPF and DKIM. Verify the request, not the header.
• Training only for one-shot phishing: Kimsuky opens with a harmless message and waits. Simulations should include multi-message conversations.
• Ignoring personal accounts: experts are often reached through personal webmail and social media, outside corporate controls.
• Allowing any browser extension: AA20-301A records an extension distributed through the Chrome Web Store that stole passwords and cookies.

Practitioner checklist

• Map which staff, fellows and advisers match Kimsuky's targeting and brief them on the advisory red flags.
• Move every owned domain to DMARC p=reject, with rua reporting.
• Require phishing-resistant MFA for email, cloud storage and remote access for high-risk users.
• Block automatic forwarding to external domains and alert on new inbox rules.
• Allowlist browser extensions and restrict PowerShell for standard users.
• Check Reply-To mismatches in mail filtering and flag them to users.
• After any suspected compromise, revoke sessions and app passwords, remove rules, and review sign-ins, not just reset the password.
• Report suspected targeting to IC3 with #KimsukyCSA and preserve the original emails.

Standards and references

• FBI, US State Department and NSA: North Korean Actors Exploit Weak DMARC Security Policies to Mask Spearphishing Efforts
• NSA: US and ROK Agencies Alert DPRK Cyber Actors Impersonating Targets to Collect Intelligence
• CISA, FBI and CNMF: North Korean Advanced Persistent Threat Focus, Kimsuky (AA20-301A)
• MITRE ATT&CK: Kimsuky (G0094)
• Mandiant: APT43, North Korean Group Uses Cybercrime to Fund Espionage Operations
• Help Net Security: North Korean Hackers Spotted Using ClickFix Tactic to Deliver Malware
• The Register: North Korean Group Creates Fake South Korean Military ID with ChatGPT
• NIST: SP 800-53 Rev. 5

Related NHI Mgmt Group resources: Threat Actor Groups Guide · DMARC, SPF and DKIM Guide · Phishing-Resistant MFA Guide · Email Security Guide · Deepfake and AI Impersonation Guide