Kimsuky has exfiltrated stolen files and data to actor-controlled Blogspot accounts.(Citation: Talos Kimsuky Nov 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1102.002|Bidirectional Communication|

Kimsuky has used Blogspot pages for C2.(Citation: Talos Kimsuky Nov 2021)|
|mitre-attack|enterprise-attack|Windows|T1012|Query Registry|

Kimsuky has obtained specific Registry keys and values on a compromised host.(Citation: Talos Kimsuky Nov 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1136.001|Local Account|

Kimsuky has created accounts with

Kimsuky has added accounts to specific groups with

Kimsuky has run

Kimsuky has checked for the presence of antivirus software with

Kimsuky has executed malware with

Kimsuky has downloaded additional malware with scheduled tasks.(Citation: KISA Operation Muzabi)|
|mitre-attack|enterprise-attack|Linux,Windows,macOS|T1111|Multi-Factor Authentication Interception|

Kimsuky has used a proprietary tool to intercept one time passwords required for two-factor authentication.(Citation: KISA Operation Muzabi)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Containers|T1036.005|Match Legitimate Name or Location|

Kimsuky has renamed malware to legitimate names such as

Kimsuky has sent internal spearphishing emails for lateral movement after stealing victim information.(Citation: KISA Operation Muzabi)|
|mitre-attack|enterprise-attack|PRE|T1589.003|Employee Names|

Kimsuky has collected victim employee name information.(Citation: KISA Operation Muzabi)|
|mitre-attack|enterprise-attack|PRE|T1593.002|Search Engines|

Kimsuky has searched for vulnerabilities, tools, and geopolitical trends on Google to target victims.(Citation: KISA Operation Muzabi)|
|mitre-attack|enterprise-attack|PRE|T1591|Gather Victim Org Information|