Kimsuky
MITRE G0144Also known as APT43, Ruby Sleet, Black Banshee, Sparkling Pisces, Velvet Chollima, Springtail, Cerium
Reports
16
First seen
Nov 6, 2025
Last seen
Oct 13, 2026
Motivation
Espionage
Relationships
Filled ◆ = CVE exploited in the wild. Entities that appear together in Signalis reporting — co-mention, not confirmed collaboration. Reports naming many actors at once (weekly roundups) are excluded from relationship edges.
Targeting
Victim regions
×1×4
South Korea×4
Ukraine×1
Victim country, only when stated. Corpus is predominantly English-language reporting, so US/EU coverage is overweighted relative to true victim distribution.
Top ATT&CK techniques
T1566 Phishing ×11T1190 Exploit Public-Facing Application ×9T1041 Exfiltration Over C2 Channel ×6T1110 Brute Force ×5T1105 Ingress Tool Transfer ×5T1059.001 PowerShell ×5T1486 Data Encrypted for Impact ×5T1005 Data from Local System ×5T1078 Valid Accounts ×4T1598 Phishing for Information ×4T1204 User Execution ×3T1071.001 Application Layer Protocol: Web Protocols ×3
Indicators
cve ×121domain ×33filename ×32hash_md5 ×20url ×8hash_sha256 ×2hash_sha1 ×2registry_key ×1
Indicator values are available on Pro and via the API.
Associated CVEs
CVE-2026-3564CVE-2024-1709 (exploited)CVE-2024-4345 (exploited)CVE-2025-3935 (exploited)CVE-2025-68947 (exploited)CVE-2026-18236CVE-2026-18497CVE-2026-18830CVE-2026-20131 (exploited)CVE-2026-20272CVE-2026-34348 (exploited)CVE-2026-42608 (exploited)CVE-2026-53413 (exploited)CVE-2026-56162 (exploited)CVE-2026-56181CVE-2026-63077 (exploited)CVE-2026-63508 (exploited)CVE-2026-64564CVE-2026-64638CVE-2026-65400 (exploited)
Recent reports
High