Higaisa

MITRE ATT&CK: G0126 View on attack.mitre.org

Aliases: Higaisa

First seen
2009-01-01 00:00:00
Origin
KR
Primary motivation
espionage
Sophistication
advanced
Resource level
government
Actor type
nation-state
Profile updated
2026-07-07 11:59:11

Targeted industries: government-and-public-sector

Targeted regions: country_code:kp country_code:cn country_code:jp country_code:ru country_code:pl

Context

Higaisa is a threat group suspected to have South Korean origins. Higaisa has targeted government, public, and trade organizations in North Korea; however, they have also carried out attacks in China, Japan, Russia, Poland, and other nations. Higaisa was first disclosed in early 2019 but is assessed to have operated as early as 2009.

Detection coverage

  • 12 YARA rules
  • 411 Sigma rules

Malware & tools used

  • Visual Basic (attack-pattern)
  • Native API (attack-pattern)
  • Exfiltration Over C2 Channel (attack-pattern)
  • DLL (attack-pattern)
  • System Time Discovery (attack-pattern)
  • Internal Proxy (attack-pattern)
  • Malicious File (attack-pattern)
  • Encrypted/Encoded File (attack-pattern)
  • Scheduled Task (attack-pattern)
  • System Information Discovery (attack-pattern)
  • Spearphishing Attachment (attack-pattern)
  • Web Protocols (attack-pattern)
  • Protocol or Service Impersonation (attack-pattern)
  • Exploitation for Client Execution (attack-pattern)
  • Scheduled Transfer (attack-pattern)
  • JavaScript (attack-pattern)
  • Binary Padding (attack-pattern)
  • Compression (attack-pattern)
  • XSL Script Processing (attack-pattern)
  • Hidden Window (attack-pattern)
  • Symmetric Cryptography (attack-pattern)
  • Local Storage Discovery (attack-pattern)
  • Registry Run Keys / Startup Folder (attack-pattern)
  • Process Discovery (attack-pattern)
  • Masquerade Task or Service (attack-pattern)

Reports & references

  • s.tencent.com — 836 (report)
  • blog.malwarebytes.com — Higaisa (report)
  • ptsecurity.com — Covid 19 And New Year Greetings The Higaisa Group (report)
  • MITRE ATT&CK — G0126 (report)
  • zscaler.com — Return Higaisa Apt (report)

External references