MITRE ATT&CKgroup

G0126 Higaisa

Published 2021-03-05 Modified 2026-07-31 Official page ↗
Domain
enterprise
Version
1.2
Created
2021-03-05

Description

Higaisa is a threat group suspected to have South Korean origins. Higaisa has targeted government, public, and trade organizations in North Korea; however, they have also carried out attacks in China, Japan, Russia, Poland, and other nations. Higaisa was first disclosed in early 2019 but is assessed to have operated as early as 2009.

Related

Uses · MITRE ATT&CK (31)

  • T1680 Local Storage Discovery technique
  • T1027.015 Compression sub-technique
  • T1027.013 Encrypted/Encoded File sub-technique
  • T1059.007 JavaScript sub-technique
  • T1573.001 Symmetric Cryptography sub-technique
  • T1001.003 Protocol or Service Impersonation sub-technique
  • T1071.001 Web Protocols sub-technique
  • T1090.001 Internal Proxy sub-technique
  • T1564.003 Hidden Window sub-technique
  • T1574.001 DLL sub-technique
  • T1204.002 Malicious File sub-technique
  • T1059.003 Windows Command Shell sub-technique
  • T1059.005 Visual Basic sub-technique
  • T1566.001 Spearphishing Attachment sub-technique
  • T1036.004 Masquerade Task or Service sub-technique
  • T1027.001 Binary Padding sub-technique
  • T1547.001 Registry Run Keys / Startup Folder sub-technique
  • T1053.005 Scheduled Task sub-technique
  • T1220 XSL Script Processing technique
  • T1203 Exploitation for Client Execution technique
  • S0160 certutil software (tool)
  • T1140 Deobfuscate/Decode Files or Information technique
  • S0013 PlugX software (malware)
  • S0032 gh0st RAT software (malware)
  • T1016 System Network Configuration Discovery technique
  • T1029 Scheduled Transfer technique
  • T1041 Exfiltration Over C2 Channel technique
  • T1057 Process Discovery technique
  • T1082 System Information Discovery technique
  • T1106 Native API technique
Show all 31 ›

References