Higaisa is a threat group suspected to have South Korean origins. Higaisa has targeted government, public, and trade organizations in North Korea; however, they have also carried out attacks in China, Japan, Russia, Poland, and other nations. Higaisa was first disclosed in early 2019 but is assessed to have operated as early as 2009.123
- Malwarebytes Higaisa 2020
- Zscaler Higaisa 2020
- PTSecurity Higaisa 2020
Claims and citations
Every claim comes from a writer; provenance is the writer's assertion, not a review verdict from this directory. Validity reads by citation year.
| predicate | object | Valid | Conf. | Evidence |
|---|---|---|---|---|
| also_known_as | Higaisa | — → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.005 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1106 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1041 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1574.001 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1124 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1090.001 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1204.002 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1027.013 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1053.005 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1082 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1566.001 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1071.001 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1001.003 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1203 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1029 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.007 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1027.001 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1027.015 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1220 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1564.003 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1573.001 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1680 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1547.001 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1057 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1036.004 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1016 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.003 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1140 | 2021 → … | 100 | src_mitre_attck_enterprise |
Technique use
| ATT&CK | Technique | platforms |
|---|---|---|
| T1001.003 | Protocol or Service Impersonation | — |
| T1016 | System Network Configuration Discovery | — |
| T1027.001 | Binary Padding | — |
| T1027.013 | Encrypted/Encoded File | — |
| T1027.015 | Compression | — |
| T1029 | Scheduled Transfer | — |
| T1036.004 | Masquerade Task or Service | — |
| T1041 | Exfiltration Over C2 Channel | — |
| T1053.005 | Scheduled Task | — |
| T1057 | Process Discovery | — |
| T1059.003 | Windows Command Shell | — |
| T1059.005 | Visual Basic | — |
| T1059.007 | JavaScript | — |
| T1071.001 | Web Protocols | — |
| T1082 | System Information Discovery | — |
| T1090.001 | Internal Proxy | — |
| T1106 | Native API | — |
| T1124 | System Time Discovery | — |
| T1140 | Deobfuscate/Decode Files or Information | — |
| T1203 | Exploitation for Client Execution | — |
| T1204.002 | Malicious File | — |
| T1220 | XSL Script Processing | — |
| T1547.001 | Registry Run Keys / Startup Folder | — |
| T1564.003 | Hidden Window | — |
| T1566.001 | Spearphishing Attachment | — |
| T1573.001 | Symmetric Cryptography | — |
| T1574.001 | DLL | — |
| T1680 | Local Storage Discovery | — |
Aliases
Higaisa
Reading and review
Records are auto-ingested and not human-reviewed. Confidence is the writer's 0–100 value; bands split at ≥80 / 50–79 / <50 into high / medium / low. The four trust axes (synthetic, lifecycle, band, source count) stay separate and never merge into one score.