Higaisa

APT / StateG0126 ↗
Origin🇰🇵 Coreia do Norte
Techniques (MITRE ATT&CK)28
SourceMITRE ATT&CK
State sponsor: Korea (Republic of)Target categories: Government
Targeted regions: China · North Korea · Japan · Nepal · Singapore · Russia · Poland · Switzerland

Vexday analysis

Higaisa é um grupo de ameaça persistente avançada (APT) com suspeita de origem sul-coreana, identificado no MITRE ATT&CK como G0126. O grupo tem como alvos organizações governamentais, públicas e comerciais na Coreia do Norte, além de ter conduzido ataques na China, Japão, Rússia, Polônia e outros países. Divulgado publicamente no início de 2019, o grupo é avaliado como operante desde pelo menos 2009. Sua atividade está documentada em 28 técnicas no MITRE ATT&CK, com 1 CVE atribuída ao seu arsenal.

Attack chain

Plausible scenario built from the group's real techniques, ordered by the phases of an attack. Each step shows how the group typically operates.

Arsenal severity48
Impact: High
T1566.001T1053.005T1547.001T1016ENTRYInitial accessSpearphishingAttachmentEXECExecutionScheduled TaskPERSPersistenceRegistry Run Keys/ Startup FolderDISCDiscoverySystem NetworkConfiguration Dis…EXFILExfiltrationScheduled Transfer

Illustrative chain derived from techniques documented in MITRE ATT&CK — it does not represent a specific past attack. Severity summarizes the known arsenal (kill-chain coverage, actively exploited CVEs, techniques).

Techniques (MITRE ATT&CK) 28

How the group operates, mapped to the MITRE ATT&CK matrix and organized by the phases of an attack.

Initial access
Spearphishing Attachment
Execution
Scheduled TaskWindows Command ShellVisual BasicJavaScriptNative APIExploitation for Client ExecutionMalicious File
Persistence
Registry Run Keys / Startup Folder
Discovery
System Network Configuration DiscoveryProcess DiscoverySystem Information DiscoverySystem Time DiscoveryLocal Storage Discovery
Command and control
Protocol or Service ImpersonationWeb ProtocolsInternal ProxySymmetric Cryptography
Exfiltration
Scheduled TransferExfiltration Over C2 Channel
stealth
Binary PaddingEncrypted/Encoded FileCompressionMasquerade Task or ServiceDeobfuscate/Decode Files or InformationXSL Script ProcessingHidden WindowDLL

Exploited vulnerabilities 1

CVEs this group is known to exploit, per MITRE ATT&CK. Ordered by real-world severity.

CVE-2018-0798HIGHEPSS 91%KEV

Known infrastructure 3

Real indicators (C2, domains, URLs and hashes) associated with the malware this group uses. Source: abuse.ch (ThreatFox, URLhaus, MalwareBazaar).

sha256_hash96c0911c225219cfd380076f5196d7ee87c617cddb968d3d465122473e20d6fbGh0stRATmalwarebazaar
sha256_hash0e8553970999b60c3a0a2637e0c282ca52b33d3e3ae88c99b6fa426bddc0075dGh0stRATmalwarebazaar
sha256_hash69e2433df06b829e98e5a6c8f552b9371795fb65df62fa4cfb7362970d1ce744Gh0stRATmalwarebazaar

References

Higaisa uses real techniques and exploits real flaws. TrueHacking's AI Autonomous Pentest simulates these attacks against your infrastructure and brings more security to your application.

Explore the AI Autonomous Pentest →