Kimsuky G0094
Also known as Black Banshee, Velvet Chollima, Emerald Sleet, THALLIUM, APT43, TA427.
Kimsuky is a Democratic People's Republic of Korea (DPRK)-based cyber espionage group that has been active since at least 2012. The group initially targeted South Korean government agencies, think tanks, and subject-matter experts in various fields. Its operations expanded to include the United Nations and organizations in the government, education, business services, and manufacturing sectors across the United States, Japan, Russia, and Europe. Kimsuky has focused collection on foreign policy and national security issues tied to the Korean Peninsula, nuclear policy, and sanctions. Kimsuky operations have overlapped with those of other North Korean state-sponsored cyber espionage actors as a result of ad hoc collaborations or other limited resource sharing.
Documented targeting: Government, Energy & Utilities, Manufacturing, Education & Research, NGO & Political
Methodology
Relevance is a match on your industry sector and technology stack against the MITRE ATT&CK v19.1 group graph (174 groups, 821 software families, 56 campaigns). It is computed deterministically from that data, with no language model in the request path. It is a relevance match, not threat-intelligence probability data: it tells you which documented actors and techniques are worth emulating for an org like yours, not a forecast that any specific group will act.
TurboPentest can autonomously exercise 9 of 130 of this actor's documented techniques today (7%). 39 are out of scope for automated testing (social engineering, denial of service, physical).
+73 coming soonmore unlock with our internal pentesting agent, currently in private beta.
These counts are computed from the vendored MITRE ATT&CK graph and the published coverage map, and are reproducible from source.
In-scope techniques to emphasize
Known software
Mimikatz, PsExec, gh0st RAT, schtasks, certutil, Gold Dragon, Brave Prince, QuasarRAT, NOKKI, BabyShark, KGH_SPY, CSPY Downloader, AppleSeed, Amadey, Troll Stealer, GoBear, Gomir, TRANSLATEXT, HTTPTroy.
Emulate Kimsuky. Audit-Ready pentest, $99.
Finds nothing? Your next pentest is free. If a pentest surfaces zero actionable findings, we credit you a free re-pentest. Once per target; does not apply to retests or Recon. You always walk away with real findings or a free redo.
Launch this pentestFrequently asked questions
Who is Kimsuky (G0094)?
Kimsuky is a Democratic People's Republic of Korea (DPRK)-based cyber espionage group that has been active since at least 2012. The group initially targeted South Korean government agencies, think tanks, and subject-matter experts in various fields. Its operations expanded to include the United Nations and organizations in the government, education, business services, and manufacturing sectors across the United States, Japan, Russia, and Europe. Kimsuky has focused collection on foreign policy and national security issues tied to the Korean Peninsula, nuclear policy, and sanctions. Kimsuky operations have overlapped with those of other North Korean state-sponsored cyber espionage actors as a result of ad hoc collaborations or other limited resource sharing.
What sectors does Kimsuky target?
Based on MITRE ATT&CK, Kimsuky has been observed targeting Government, Energy & Utilities, Manufacturing, Education & Research, NGO & Political.
Can TurboPentest test for Kimsuky?
TurboPentest can autonomously exercise 9 of 130 of this actor's documented techniques today. 73 more need internal or assumed-breach access (the Adversarial-Depth tier), and the rest are out of scope for automated testing.
What does it cost to emulate Kimsuky?
An Audit-Ready pentest starts at $99 per target. If it surfaces zero actionable findings, your next pentest is free.
Reviewed by
Michel Chamberland, Founder & CEO of IntegSec. CISSP, OSCP, OSCE, with 20+ years in offensive security, alumni of IBM X-Force Red and Trustwave SpiderLabs.
Last reviewed July 30, 2026.