Springtail - DPRK Threat Actor | lazarus.day

Springtail

2024-03-20 • Symantec • New DEEP#GOSU campaign attributed to Springtail A…

42

Related Actors
5

Related Reports

Related Actors

APT-C-55

Qihoo360

Kimsuky

First seen: Nov 2021

Last seen: May 2026

Black Banshee

PWC

Kimsuky

First seen: Feb 2020

Last seen: May 2026

TAG-46

Recorded Future

Kimsuky

First seen: Jan 2024

Last seen: Jan 2024

TAG-66

Recorded Future

Kimsuky

First seen: Jan 2024

Last seen: Jan 2024

KTA082

Kroll

Kimsuky

First seen: Mar 2024

Last seen: Mar 2024

Cerium

Microsoft

Kimsuky

First seen: Oct 2021

Last seen: Nov 2022

UNC1873

Mandiant

APT43

First seen: Mar 2023

Last seen: Mar 2023

G0094

MITRE

Kimsuky

First seen: Aug 2019

Last seen: Aug 2019

NNPTGroup

Self Given

Kimsuky

First seen: Apr 2015

Last seen: Apr 2015

Whoam I

Self Given

NNPTGroup

First seen: Apr 2015

Last seen: Apr 2015

Kimsuky

Kaspersky

First seen: Sep 2013

Last seen: Jun 2026

Phisherman

KRCERT

Kimsuky

UAT-5394

Cisco Talos

Kimsuky

First seen: Aug 2024

Last seen: Sep 2024

Sharp Tongue

Volexity

Kimsuky

First seen: Jul 2022

Last seen: Oct 2023

Sparkling Pisces

Paloalto Networks

Kimsuky

First seen: Sep 2024

Last seen: May 2026

TA408

Proofpoint

Kimsuky

First seen: Nov 2021

Last seen: Nov 2021

TA427

Proofpoint

Kimsuky

First seen: Nov 2021

Last seen: Jul 2025

Thallium

Microsoft

Kimsuky

First seen: Dec 2019

Last seen: Feb 2022

Seedpu NK

S2W

Kimsuky

First seen: Oct 2024

Last seen: Oct 2024

Dark Plum

NTTSecurity

Kimsuky

First seen: Oct 2024

Last seen: Apr 2025

Red Kim

KRCERT

Kimsuky

Larva-24005

Ahnlab

Kimsuky

First seen: Feb 2025

Last seen: Apr 2025

pu NK-004

S2W

Kimsuky

First seen: Mar 2025

Last seen: Mar 2025

Earth Kumiho

Trend Micro

Kimsuky

First seen: May 2022

Last seen: Apr 2026

Sector A05

NSHC

Kimsuky

First seen: Jan 2019

Last seen: Jul 2025

Larva-25004

Ahnlab

Kimsuky

First seen: May 2025

Last seen: Nov 2025

UNC1130

Mandiant

Kimsuky

First seen: Aug 2022

Last seen: Aug 2022

Velvet Chollima

Crowd Strike

Kimsuky

First seen: Feb 2019

Last seen: May 2026

RGB-D5

Issuemakers Lab

Kimsuky

First seen: Apr 2020

Last seen: Dec 2020

Larva-25010

Ahnlab

Kimsuky

First seen: Oct 2025

Last seen: Oct 2025

APT-Q-2

Qianxin

Kimsuky

First seen: Mar 2022

Last seen: Jun 2025

Nickel Kimball

Secure Works

Kimsuky

First seen: May 2022

Last seen: Oct 2024

APT43

Mandiant

Kimsuky

First seen: Mar 2023

Last seen: May 2026

ARCHIPELAGO

Google

APT43

First seen: Apr 2023

Last seen: Apr 2023

Pathetic Slug

Cloudflare

Kimsuky

First seen: Mar 2026

Last seen: Mar 2026

Ruby Sleet

Microsoft

Cerium

First seen: Apr 2023

Last seen: May 2026

Emerald Sleet

Microsoft

Thallium

First seen: Apr 2023

Last seen: Mar 2026

UNC3782

Mandiant

APT43

First seen: Apr 2023

Last seen: Nov 2025

UNC4469

Mandiant

APT43

First seen: Apr 2023

Last seen: Apr 2023

ITG16

IBM

Kimsuky

First seen: Mar 2024

Last seen: Mar 2024

Cloud Dragon

Team T5

Kimsuky

First seen: May 2021

Last seen: May 2023

Kim Dragon

Team T5

Kimsuky

First seen: May 2021

Last seen: May 2021

Related Reports

Top Authors

View all reports in this cluster

2026-05-14

Kaspersky

Disclosing new PebbleDash-based tools by Kimsuky

#Kimsuky #APT43 #RubySleet #BlackBanshee #SparklingPisces #VelvetChollima #Springtail #PebbleDash #AppleSeed #HappyDoor #HttpTroy #VSCode #GitHub #Phishing #JSE #ADS #T1566.001 #T1059.001 #T1059.003 #T1105 #T1053.005 #T1547.001 #T1543.003 #T1219 #T1027 #T1005 #T1113 #T1056.001 #T1041 #T1071.001

2025-04-07

Symantec

Springtail APT group targets South Korean government entities

#Springtail #LNK

2024-05-16

Symantec

Springtail: New Linux Backdoor Added to Toolkit

#Gomir #Springtail #TrollStealer #GoBear

2024-03-21

Symantec

Springtail APT group abuses valid certificate of known Korean public entity

#Springtail

2024-03-20

Symantec

New DEEP#GOSU campaign attributed to Springtail APT (aka Kimsuky)

#Springtail

View all reports in this cluster