Kimsuky has collected victim organization information including but not limited to organization hierarchy, functions, press releases, and others.(Citation: KISA Operation Muzabi)|
|mitre-attack|enterprise-attack|PRE|T1594|Search Victim-Owned Websites|

Kimsuky has searched for information on the target company's website.(Citation: KISA Operation Muzabi)|
|mitre-attack|enterprise-attack|PRE|T1585.002|Email Accounts|

Kimsuky has created email accounts for phishing operations.(Citation: KISA Operation Muzabi)|
|mitre-attack|enterprise-attack|PRE|T1583.004|Server|

Kimsuky has purchased hosting servers with virtual currency and prepaid cards.(Citation: KISA Operation Muzabi)|
|mitre-attack|enterprise-attack|PRE|T1587.001|Malware|

Kimsuky has developed its own unique malware such as MailFetch.py for use in operations.(Citation: KISA Operation Muzabi)(Citation: Talos Kimsuky Nov 2021)|
|mitre-attack|enterprise-attack|PRE|T1584.001|Domains|

Kimsuky has compromised legitimate sites and used them to distribute malware.(Citation: KISA Operation Muzabi)|
|mitre-attack|enterprise-attack|PRE|T1588.005|Exploits|

Kimsuky has obtained exploit code for various CVEs.(Citation: KISA Operation Muzabi)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1204.001|Malicious Link|

Kimsuky has lured victims into clicking malicious links.(Citation: KISA Operation Muzabi)|
|mitre-attack|enterprise-attack|PRE|T1585.001|Social Media Accounts|

Kimsuky has created social media accounts to monitor news and security trends as well as potential targets.(Citation: KISA Operation Muzabi)|
|mitre-attack|enterprise-attack|Windows,IaaS,Network,Linux,macOS,Containers|T1190|Exploit Public-Facing Application|