Kimsuky has modified Registry settings for default file associations to enable all macros and for persistence.(Citation: CISA AA20-301A Kimsuky)(Citation: Crowdstrike GTR2020 Mar 2020)(Citation: Talos Kimsuky Nov 2021)(Citation: KISA Operation Muzabi)|
|mitre-attack|enterprise-attack|Windows,Linux,Containers,macOS|T1133|External Remote Services|

Kimsuky has used RDP to establish persistence.(Citation: CISA AA20-301A Kimsuky)|
|mitre-attack|enterprise-attack|Windows,Linux,macOS|T1036.004|Masquerade Task or Service|

Kimsuky has disguised services to appear as benign software or related to operating system functions.(Citation: CISA AA20-301A Kimsuky)|
|mitre-attack|enterprise-attack|Windows,macOS,Linux|T1059.007|JavaScript|

Kimsuky has used JScript for logging and downloading additional tools.(Citation: VirusBulletin Kimsuky October 2019)(Citation: CISA AA20-301A Kimsuky)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1071.002|File Transfer Protocols|

Kimsuky has used FTP to download additional malware to the target machine.(Citation: VirusBulletin Kimsuky October 2019)|
|mitre-attack|enterprise-attack|PRE|T1598.003|Spearphishing Link|

Kimsuky has used links in e-mail to steal account information.(Citation: VirusBulletin Kimsuky October 2019)(Citation: Malwarebytes Kimsuky June 2021)(Citation: KISA Operation Muzabi)|
|mitre-attack|enterprise-attack|PRE|T1586.002|Email Accounts|

Kimsuky has compromised email accounts to send spearphishing e-mails.(Citation: VirusBulletin Kimsuky October 2019)(Citation: Malwarebytes Kimsuky June 2021)|
|mitre-attack|enterprise-attack|PRE|T1587|Develop Capabilities|