Home / Threat actors / Higaisa
Higaisa G0126
Updated at source on Jul 31, 2026 · View on MITRE ATT&CK
1
associated CVEs
32
Techniques
3
Malware and tools
Higaisa is a threat group suspected to have South Korean origins. Higaisa has targeted government, public, and trade organizations in North Korea; however, they have also carried out attacks in China, Japan, Russia, Poland, and other nations. Higaisa was first disclosed in early 2019 but is assessed to have operated as early as 2009.
Exploited vulnerabilities
CVEs cited by MITRE ATT&CK for this group, with the source excerpt. Records not yet published here appear without a link.
“Higaisa has exploited CVE-2018-0798 for execution.”
Techniques by tactic
Initial Access
T1566.001 Spearphishing Attachment Execution
T1053.005 Scheduled TaskT1059.003 Windows Command ShellT1059.005 Visual BasicT1059.007 JavaScriptT1106 Native APIT1203 Exploitation for Client ExecutionT1204.002 Malicious FileT1574.001 DLL Persistence
T1053.005 Scheduled TaskT1547.001 Registry Run Keys / Startup Folder Privilege Escalation
T1053.005 Scheduled TaskT1547.001 Registry Run Keys / Startup Folder Stealth
T1027.001 Binary PaddingT1027.013 Encrypted/Encoded FileT1027.015 CompressionT1036.004 Masquerade Task or ServiceT1140 Deobfuscate/Decode Files or InformationT1220 XSL Script ProcessingT1564.003 Hidden WindowT1574.001 DLL Discovery
T1016 System Network Configuration DiscoveryT1057 Process DiscoveryT1082 System Information DiscoveryT1124 System Time DiscoveryT1680 Local Storage Discovery Command and Control
T1001.003 Protocol or Service ImpersonationT1071.001 Web ProtocolsT1090.001 Internal ProxyT1573.001 Symmetric Cryptography Exfiltration
T1029 Scheduled TransferT1041 Exfiltration Over C2 Channel © The MITRE Corporation. ATT&CK® content reproduced and distributed with the permission of The MITRE Corporation.