Kimsuky is a North Korea-linked espionage group focused on intelligence collection through phishing, including QR-code and credential-harvesting lures.
Key facts
- Targets think tanks, government, academia and researchers, often on Korean-peninsula topics.
- Relies heavily on spear-phishing and credential theft.
- Has used QR codes and fake login pages to capture credentials.
- Conducts long-term intelligence collection rather than destruction.
Why it matters
Kimsuky shows how persistent phishing fuels espionage. Detecting harvested credentials early limits how far they can reach.
How DarkThreatX helps
DarkThreatX tracks threat-actor activity, leaked credentials and exposed data across the dark web so security teams can act on early warning. Run a free dark web scan or explore the platform.
