Threat Intelligence Tarot
Major Arcana · 10
North Korea (RGB)
G0094★★★★★
risk 3/5
✦ The Whisperer ✦
Kimsuky
Thallium · Black Banshee · Velvet Chollima · APT-C-55
Think tanksAcademic researchersJournalistsSouth Korean governmentNuclear experts
Active since ~2012 · Intelligence collection, Policy research, Sanctions monitoring
It reads your emails about nuclear policy before you send the reply. It listens to your research conversations and reports to Pyongyang on what the outside world thinks of North Korea's next move. It is an ear pressed against the wall of every room that matters.
Tactics & Techniques
RCN
RDV
INI
EXC
PRS
PRV
EVA
CRD
DSC
LAT
COL
C2
EXF
IMP
Notable Operations
- ◆Operation Smoke Screen (South Korean targets)
- ◆COVID-19 vaccine researcher targeting
- ◆Nuclear policy think tank access
- ◆Operation Stolen Pencil (academic credential theft)
Defenses
- ▸Phishing awareness training with political and research themesNIST CSF: PR.AT ↗
- ▸Google Workspace / M365 advanced threat protectionCIS Control 9 ↗
- ▸Browser isolation for high-risk researcher workflowsCIS Control 9 ↗
- ▸Endpoint keylogger detection and process monitoringCIS Control 10 ↗
Reversed: Their Weakness
Kimsuky's targeting is sometimes so narrow that victims can identify the operation simply by recognizing they received an email. Its precision is a double-edged sword - targeted actors are more likely to report it.
Share this adversary profile
swipe to browse
Related Adversaries
Data sourced from MITRE ATT&CK. For educational purposes.