OAK — OnChain Attack Knowledge

Worked example · 2018-20

APT43 / Kimsuky crypto-funded espionage — 2018–2025

Loss
Infrastructure case, not a per-victim loss. APT43/Kimsuky (OAK-G07), a DPRK Reconnaissance General Bureau (RGB) sub-element, conducts strategic cyber-espionage as its primary mission, with cryptocurrency theft and laundering as a self-funding support function. The cluster's cryptocurrency-funded operational model — documented in detail by Mandiant's March 2023 APT43 report — involves theft of cryptocurrency from exchanges and DeFi protocols to fund espionage operations, making it the prototype of the "espionage-first, crypto-self-funding" DPRK cluster type, distinct from the "crypto-theft-as-primary-mission" Lazarus Group (OAK-G01) cluster.
OAK Techniques observed
OAK-T15.001 (Social Engineering of Operator Personnel) — Kimsuky's spear-phishing campaigns targeting crypto-exchange employees and crypto-startup personnel for credential harvesting and initial access. OAK-T4.001 (Spear-Phishing Credential Harvesting) — the primary initial-access vector for Kimsuky's crypto-targeted operations. OAK-T8.001 (Cluster Reuse / Operator Fingerprinting) — Kimsuky's distinctive TTP fingerprint (spear-phishing with weaponized Office documents, BabyShark/MagicRAT malware families, alpha-empire.ru C2 infrastructure) enables cluster attribution distinct from Lazarus Group.
OAK-Gnn
OAK-G07 APT43 / Kimsuky.
Attribution
confirmed at the cluster-and-state-attribution level — OFAC SDN designation of Kimsuky on November 30, 2023 ([ofac2023kimsuky]); Republic of Korea sanctions designation (June 2023); joint BfV/NIS advisory (March 2023); Mandiant APT43 report (March 2023, [mandiantapt432023]); external Group ID G0094 with sustained multi-vendor corroboration.
Key teaching point
Kimsuky demonstrates the DPRK "espionage-first, crypto-self-funding" cluster type: the cluster's primary mission is strategic intelligence collection; cryptocurrency theft is a means to that end, not the end itself. This distinguishes G07 from G01 (Lazarus — crypto theft as primary regime-revenue mission) and G08 (BlueNoroff — macOS-engineering-led crypto-firm intrusion for financial theft). The G01/G07/G08 partition is a load-bearing OAK structural distinction: the clusters share RGB parent-organisation substrate but differ in mission priority, targeting pattern, and TTP fingerprint.

Summary

APT43/Kimsuky has been active since at least 2012, with a primary mission of strategic cyber-espionage targeting government, diplomatic, academic, and think-tank entities in South Korea, Japan, the United States, and Europe. The cluster's cryptocurrency-funded operational model was first publicly characterised in detail by Mandiant's March 2023 APT43 report, which documented the cluster's use of cryptocurrency theft to fund its espionage operations — a "self-funding" model that reduces dependence on Pyongyang's central budget allocation.

The cluster's crypto-relevant TTPs include: (1) spear-phishing campaigns against cryptocurrency exchange employees and crypto-startup personnel for credential harvesting; (2) deployment of the BabyShark and MagicRAT malware families against crypto-adjacent targets; (3) laundering of stolen cryptocurrency through the broader DPRK laundering infrastructure shared with Lazarus Group and BlueNoroff.

The boundary between G07 (APT43/Kimsuky) and G01 (Lazarus Group/APT38) is operationally meaningful but not always cleanly resolvable per-incident from public reporting: both clusters target crypto entities, both launder through shared infrastructure, and both operate under RGB authority. OAK records the partition based on mission priority (espionage vs. financial theft), TTP fingerprint (spear-phishing vs. supply-chain compromise), and industry-forensic cluster taxonomy (Mandiant, CrowdStrike, Microsoft, KISA).

Timeline (UTC)

When Event OAK ref
2012 Kimsuky activity first observed; initial targeting of South Korean government and academic entities (pre-crypto)
2018–2019 Kimsuky crypto-funded operational model emerges; first documented crypto-targeted spear-phishing campaigns T15.001 / T4.001
2023-03 Mandiant APT43 report publicly characterises the crypto-funded operational model in technical detail (attribution milestone)
2023-06 Republic of Korea sanctions Kimsuky — first South Korean sanctions against a North Korean hacking group (attribution milestone)
2023-11 OFAC SDN designation of Kimsuky; U.S. Treasury formally attributes the cluster to DPRK RGB (attribution milestone)
Continuing Kimsuky crypto-targeted operations remain active at v0.1 cutoff (ongoing)

Public references

  • Mandiant: APT43 — An investigation into the DPRK's strategic cyber-espionage group, March 28, 2023 ([mandiantapt432023]).
  • OFAC: Kimsuky SDN designation, November 30, 2023 ([ofac2023kimsuky]).
  • Republic of Korea Ministry of Foreign Affairs / NIS: Kimsuky sanctions designation, June 2, 2023 ([mofakimsuky2023]).
  • BfV / NIS: Joint advisory on Kimsuky TTPs, March 20, 2023 ([bfvnis2023kimsuky]).

Techniques demonstrated (3)