- Category
- State · Attributed to a state or working for one.
- Origin
- North Korea(high confidence)
- Motivation
- Information theft and espionage
- Seen
- 2019
- Sources
- 6 sources carry it
- Identifier
- GINC-APT-0293 · earth-kitsune
North KoreaWhat it is
Earth Kitsune is an advanced persistent threat actor that has been active since at least 2019. They primarily target individuals interested in North Korea and use various tactics, such as compromising websites and employing social engineering, to distribute self-developed backdoors. Earth Kitsune demonstrates technical proficiency and continuously evolves their tools, tactics, and procedures. They have been associated with malware such as WhiskerSpy and SLUB.
Names
The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.
- Operations
- Operation Earth Kitsune
Attribution
Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.
Western sources
- ETDA / ThaiCERTNorth Korea
- ThreatActor.info (Malpedia et al.)North Korea
Tools
The tools and malware families the sources tie to it.
- Backdoor.Oldrea
- SLUB
- WhiskerSpy
- agfSpy
- dneSpy
Sources
- ETDA Threat Group Card apt.etda.or.th
- Malpedia malpedia.caad.fkie.fraunhofer.de