#Kimsuky

DPRK-aligned APT, also Velvet Chollima, TA427, Black Banshee

Subscribe (RSS)


#Kimsuky

DPRK-aligned APT (Velvet Chollima, TA427)

Subscribe (RSS)

IOCs by window

Today

2

IOCs tagged #Kimsuky

Week

2

IOCs tagged #Kimsuky

Month

42

IOCs tagged #Kimsuky

Year

13,319

IOCs tagged #Kimsuky

Counts as of 2026-10-28. Regenerated daily.

About #Kimsuky

  • Actor: DPRK-aligned APT, active since at least 2012.
  • Also called: Velvet Chollima (CrowdStrike), TA427 (Proofpoint), Black Banshee (Mandiant).
  • Targets: South Korean government, defense, academia. Also US, Japan, Europe think tanks.
  • Tactics: Spear-phishing with HWP and PDF files. Fake login pages.
  • Malware: BabyShark, AppleSeed, GoldDragon.
  • References: MITRE ATT&CK G0094 · CISA AA20-301A

Recent IOCs tagged #Kimsuky

Latest 10 IOCs from the past 30 days. Live JSON: api.tweetfeed.live/v1/month/kimsuky.

Date Type Value Source
Oct 28, 15:00 url http://27.102.137.57 @phatomcandle
Oct 28, 15:00 ip 27.102.137.57 @phatomcandle
Oct 20, 06:04 domain drive-sharing.work.gd @cyberwar_15
Oct 20, 06:04 url https://drive-sharing.work.gd @cyberwar_15
Oct 20, 06:04 domain drive-security.zapto.org @cyberwar_15
Oct 20, 06:04 url http://drive-security.zapto.org @cyberwar_15
Oct 18, 16:54 domain outlook365livee.dothome.co.kr @curious_drac0
Oct 18, 16:54 url http://outlook365livee.dothome.co.kr @curious_drac0
Oct 18, 16:54 domain renovar365.dothome.co.kr @curious_drac0
Oct 18, 16:54 url http://renovar365.dothome.co.kr @curious_drac0

Related tags

Often seen with #Kimsuky.

See all tags on the Dashboard or browse the full IOC feed.

Frequently asked questions

What is Kimsuky?

A DPRK-aligned APT group active since at least 2012. It targets South Korean government, defense and academic groups, and is known for spear-phishing and custom backdoors.

Is Kimsuky the same as Lazarus?

No, they are separate DPRK-aligned clusters: Lazarus focuses on financial gain, Kimsuky on intelligence collection. TweetFeed tracks #Lazarus IOCs separately.

How is this list updated?

The feed and the API update every 15 minutes from researcher posts on X. This page refreshes once a day.

What is the license? Can I use this commercially?

Yes. All IOC data, including this Kimsuky subset, is CC0 1.0 Universal. No attribution needed. No warranty. The website code and branding are not CC0.

License

Kimsuky IOC data: CC0 1.0 Public Domain. No attribution required, no warranty.