AppleSeed
The MITRE Corporation
· Published 10/06/2021 16:53 · Modified 27/03/2026 01:03
Family
Essential information
- Confidence
- 100/100
- Is family
- Yes
- Published
- 10/06/2021 16:53
- Modified
- 27/03/2026 01:03
- Revoked
- No
- Author / Source
- The MITRE Corporation
- Related entities
- 46 attack patterns (mitre), 1 intrusion sets (apt), 7 sectors, 1 countries, 30 indicators
Description
[AppleSeed](https://attack.mitre.org/software/S0622) is a backdoor that has been used by [Kimsuky](https://attack.mitre.org/groups/G0094) to target South Korean government, academic, and commercial targets since at least 2021.(Citation: Malwarebytes Kimsuky June 2021)
Marking (TLP)
TLP:CLEAR Copyright 2015-2025, The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation.
External references
Related entities
Attack patterns, malware, vulnerabilities, indicators, intrusion sets and other entities linked to this malware.
Attack patterns (MITRE) (46)
-
T1560.001 usesArchive via Utility MITRE
-
T1560 usesArchive Collected Data MITRE
-
T1005 usesData from Local System MITRE
-
T1025 usesData from Removable Media MITRE
-
T1070.004 usesFile Deletion MITRE
-
T1119 usesAutomated Collection MITRE
-
T1407 MITRE
-
T1059 usesCommand and Scripting Interpreter MITRE
-
T1218 usesSystem Binary Proxy Execution MITRE
-
T1071 usesApplication Layer Protocol MITRE
-
T1027.002 usesSoftware Packing MITRE
-
T1071.001 usesWeb Protocols MITRE
Intrusion sets (APT) (1)
-
The MITRE Corporation Confidence 100
[Kimsuky](https://attack.mitre.org/groups/G0094) is a North Korea-based cyber espionage group that has been active since at least 2012. The group initially targeted South Korean government agencies, think tanks, and subject-matter…
First seen 01/01/1970 · Last seen 16/11/5138 ·
Sectors (7)
-
Media targets
-
Government targets
-
Energy targets
-
Technology targets
-
Diplomacy targets
-
Defense targets
-
Education targets
Countries (1)
-
Korea, Republic of targets
Indicators (30)
-
http://bitburny.kro.kr/aha/indicatesstix 100/100 Revoked· Valid until 19/02/2024 · Source: AlienVault -
http://octseven1.p-e.kr//indicatesstix 100/100 Revoked· Valid until 19/02/2024 · Source: AlienVault -
http://my.topton.r-e.kr/address/indicatesstix 100/100 Revoked· Valid until 19/02/2024 · Source: AlienVault -
http://nobtwoseb1.n-e.kr//indicatesstix 100/100 Revoked· Valid until 19/02/2024 · Source: AlienVault -
http://104.168.145.83:993indicatesstix 100/100 Revoked· Valid until 12/02/2024 · Source: AlienVault -
http://bitthum.kro.kr/hu/indicatesstix 100/100 Revoked· Valid until 19/02/2024 · Source: AlienVault -
http://update.ahnlaib.kro.kr/aha/indicatesstix 100/100 Revoked· Valid until 19/02/2024 · Source: AlienVault -
http://159.100.6.137:993indicatesstix 100/100 Revoked· Valid until 12/02/2024 · Source: AlienVault