Stolen Pencil

ACTIVE CAMPAIGN TRACKED ▲ High Threat North Korea

Primary Aliases: Opal Sleet ARCHIPELAGO Crooked Pisces G0086

Sponsor / State Affiliation Government of North Korea (DPRK)

Primary Motivation Cyber espionage and intelligence gathering regarding foreign policy, nuclear sanctions, and national security

Active Timeline Unknown – Present

Confidence Rating 95% (Grounded)

KLogEXE and FPSpy Deployment, LLM-Enhanced Reconnaissance

⚔️ Weaponized CVE Matrix (0)

No specific weaponized CVEs currently mapped in the public baseline.

🎯 Target Sectors & Focus

Government Agencies Think Tanks Academic Institutions Defense Sector Energy Sector Healthcare Diplomatic Organizations

🛡️ MITRE ATT&CK® Attack Lifecycle (7 TTPs)

📥 Download Navigator JSON

Initial Access 1

T1566 Spear-phishing with geopolitical lures

Execution 1

T1059 PowerShell-based keyloggers

Persistence & Privilege Escalation 1

T1547 Remote Desktop Protocol (RDP) for persistence and manual interaction

Credential Access & Discovery 2

T1003 Use of Large Language Models (LLMs) for reconnaissance and lure generation

T1003 Credential harvesting from browser memory and process memory

Command & Control 1

T1071 Living off the Land (LotL) using built-in Windows administration tools

Operational Techniques 1

T1000 Distribution of malicious Google Chrome extensions

📰 Verified Campaigns & Intelligence Archive

🔔 Subscribe to Alerts

[DEEP DIVE] Kimsuky Integration of Local LLMs Ollama, GPT4All, Msty and GitHub C2

Attacks and Vulnerabilities 2026-08-09

Copied to clipboard

LINK COPIED TO CLIPBOARD