Loading IOCs…

{'aliases': ['Higaisa'],
 'created': '2021-03-05T18:54:56.267Z',
 'created_by_ref': 'identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5',
 'description': '[Higaisa](https://attack.mitre.org/groups/G0126) is a threat '
                'group suspected to have South Korean origins. '
                '[Higaisa](https://attack.mitre.org/groups/G0126) has targeted '
                'government, public, and trade organizations in North Korea; '
                'however, they have also carried out attacks in China, Japan, '
                'Russia, Poland, and other nations. '
                '[Higaisa](https://attack.mitre.org/groups/G0126) was first '
                'disclosed in early 2019 but is assessed to have operated as '
                'early as 2009.(Citation: Malwarebytes Higaisa 2020)(Citation: '
                'Zscaler Higaisa 2020)(Citation: PTSecurity Higaisa 2020)',
 'external_references': [{'external_id': 'G0126',
                          'source_name': 'mitre-attack',
                          'url': 'https://attack.mitre.org/groups/G0126'},
                         {'description': 'Malwarebytes Threat Intelligence '
                                         'Team. (2020, June 4). New LNK attack '
                                         'tied to Higaisa APT discovered. '
                                         'Retrieved March 2, 2021.',
                          'source_name': 'Malwarebytes Higaisa 2020',
                          'url': 'https://blog.malwarebytes.com/threat-analysis/2020/06/higaisa/'},
                         {'description': 'PT ESC Threat Intelligence. (2020, '
                                         'June 4). COVID-19 and New Year '
                                         'greetings: an investigation into the '
                                         'tools and methods used by the '
                                         'Higaisa group. Retrieved March 2, '
                                         '2021.',
                          'source_name': 'PTSecurity Higaisa 2020',
                          'url': 'https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/covid-19-and-new-year-greetings-the-higaisa-group/'},
                         {'description': 'Singh, S. Singh, A. (2020, June 11). '
                                         'The Return on the Higaisa APT. '
                                         'Retrieved March 2, 2021.',
                          'source_name': 'Zscaler Higaisa 2020',
                          'url': 'https://www.zscaler.com/blogs/security-research/return-higaisa-apt'}],
 'id': 'intrusion-set--54dfec3e-6464-4f74-9d69-b7c817b7e5a3',
 'modified': '2025-10-22T02:54:00.893Z',
 'name': 'Higaisa',
 'object_marking_refs': ['marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168'],
 'revoked': False,
 'spec_version': '2.1',
 'type': 'intrusion-set',
 'x_mitre_attack_spec_version': '3.3.0',
 'x_mitre_contributors': ['Daniyal Naeem, BT Security'],
 'x_mitre_deprecated': False,
 'x_mitre_domains': ['enterprise-attack'],
 'x_mitre_modified_by_ref': 'identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5',
 'x_mitre_version': '1.2'}