Início / Grupos de ameaça / Higaisa
Higaisa G0126
Atualizado na fonte em 31/07/2026 · Ver no MITRE ATT&CK
1
CVEs associadas
32
Técnicas
3
Malwares e ferramentas
Higaisa is a threat group suspected to have South Korean origins. Higaisa has targeted government, public, and trade organizations in North Korea; however, they have also carried out attacks in China, Japan, Russia, Poland, and other nations. Higaisa was first disclosed in early 2019 but is assessed to have operated as early as 2009.
Vulnerabilidades exploradas
CVEs citadas pelo MITRE ATT&CK para este grupo, com o trecho da fonte. Fichas ainda não publicadas aqui aparecem sem link.
“Higaisa has exploited CVE-2018-0798 for execution.”
Técnicas por tática
Acesso inicial
T1566.001 Spearphishing Attachment Execução
T1053.005 Scheduled TaskT1059.003 Windows Command ShellT1059.005 Visual BasicT1059.007 JavaScriptT1106 Native APIT1203 Exploitation for Client ExecutionT1204.002 Malicious FileT1574.001 DLL Persistência
T1053.005 Scheduled TaskT1547.001 Registry Run Keys / Startup Folder Escalada de privilégios
T1053.005 Scheduled TaskT1547.001 Registry Run Keys / Startup Folder Furtividade
T1027.001 Binary PaddingT1027.013 Encrypted/Encoded FileT1027.015 CompressionT1036.004 Masquerade Task or ServiceT1140 Deobfuscate/Decode Files or InformationT1220 XSL Script ProcessingT1564.003 Hidden WindowT1574.001 DLL Descoberta
T1016 System Network Configuration DiscoveryT1057 Process DiscoveryT1082 System Information DiscoveryT1124 System Time DiscoveryT1680 Local Storage Discovery Comando e controle
T1001.003 Protocol or Service ImpersonationT1071.001 Web ProtocolsT1090.001 Internal ProxyT1573.001 Symmetric Cryptography Exfiltração
T1029 Scheduled TransferT1041 Exfiltration Over C2 Channel © The MITRE Corporation. Conteúdo do ATT&CK® reproduzido e distribuído com permissão da MITRE Corporation. Descrições em inglês, como na fonte.