Kimsuky Uses OpenCode AI Agent and GitHub PATs in Operation GitPower Attacks
North Korea-linked threat actor Kimsuky has expanded its Operation GitPower activity with malicious LNK shortcuts, GitHub Personal Access Token (PAT)-authent...
Kimsuky
North Korean APT group focused on intelligence gathering, targeting South Korean government, think tanks, and nuclear energy organizations.
Also known as: kimsuky, velvet chollima, emerald sleet, thallium, black banshee, krypton, baby shark
AI Intelligence Brief cached
Edit Profile
Entity Relationships
Related YARA Rules View all on YARA Rules page →
90-Day Activity
Last 90 Days (5)
Last 90 Days
All Time
North Korean Hackers Hide AnyDesk on Victim PCs to Maintain Secret Remote Access
North Korea-linked Kimsuky operators have targeted organizations in South Korea and Japan with spear-phishing campaigns that install and conceal AnyDesk, giv...
Kimsuky Uses Local AI Development Environment to Expand Cyber Espionage Tooling in Operation GitPower
North Korean state-backed threat actor Kimsuky is extending its established espionage playbook with locally hosted artificial intelligence tooling, according...
Kimsuky Builds Offline AI Stack to Boost Phishing and Automate Malware Development
North Korea's state hackers are no longer content to type prompts into public chatbots. One of the country's main espionage groups has begun running artifici...
North Korean Hackers Explore AI Transcription for Stolen Calls and Meetings
North Korea-linked Kimsuky operators are expanding their artificial intelligence capabilities, with newly observed evidence showing experimentation with loca...