- Category
- State · Attributed to a state or working for one.
- Origin
- South Korea(high confidence)
- Sponsor
- State-sponsored
- Motivation
- Information theft and espionage
- Seen
- 2007–2026
- Status
- Active
- ATT&CK
- G0126 · 28 techniques
- Sources
- 7 sources carry it
- Identifier
- GINC-APT-0210 · higaisa
South KoreaWhat it is
Higaisa is a threat group suspected to have South Korean origins. Higaisa has targeted government, public, and trade organizations in North Korea; however, they have also carried out attacks in China, Japan, Russia, Poland, and other nations. Higaisa was first disclosed in early 2019 but is assessed to have operated as early as 2009.
Names
The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.
- CrowdStrike
- Shadow Crane
- Microsoft
- Zigzag Hail
- MITRE ATT&CK
- G0126
- NSA leak
- SIG25
- Qihoo 360
- APT-C-06
- Secureworks
- CTG-1948
- Operations
- Operation “DarkHotel”, Operation “Daybreak”, Operation “Inexsmar”, Operation “PowerFall”, Operation “The Gh0st Remains the Same”
- Other names
- DarkHotel, ATK 52, Dubnium, Fallout Team, Luder, Purple Pygmy, T-APT-02, TieOnJoe, Tungsten Bridge
Attribution
Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.
Western sources
- ETDA / ThaiCERTSouth Korea
- MISP Galaxy (CFR tagging)South Korea
- ThreatActor.info (Malpedia et al.)South Korea · high
Targets
- Countries
- Afghanistan, Armenia, Bangladesh, Belgium, China, Ethiopia, Germany, Greece, Hong Kong, India, Indonesia, Ireland, Israel, Italy, Japan, Kazakhstan, Kyrgyzstan, Lebanon, Malaysia, Mexico, Mozambique, Nepal, North Korea, Pakistan, Philippines, Poland, Russia, Saudi Arabia, Serbia, Singapore, South Korea, Switzerland, Taiwan, Tajikistan, Thailand, Türkiye, United Arab Emirates, United Kingdom, United States, Vietnam
- Sectors
- Defense, Energy, Government, Healthcare, Hospitality, NGOs, Pharmaceutical, Research, Technology
Tools
The tools and malware families the sources tie to it.
- Brat
- China Chopper
- MobileOrder
- PlugX
- certutil
- gh0st RAT
Sources
- MITRE ATT&CK attack.mitre.org
- ETDA Threat Group Card apt.etda.or.th
- Malpedia malpedia.caad.fkie.fraunhofer.de