Higaisa is a threat group suspected to have South Korean origins. Higaisa has targeted government, public, and trade organizations in North Korea; however, they have also carried out attacks in China, Japan, Russia, Poland, and other nations. Higaisa was first disclosed in early 2019 but is assessed to have operated as early as 2009.123
- Malwarebytes Higaisa 2020
- Zscaler Higaisa 2020
- PTSecurity Higaisa 2020
断言与引用
每条断言来自写入方；provenance 是写入方声称，不是本目录的复核结论。有效期按引用年份读取。
| predicate | object | 有效期 | 置信 | 证据 |
|---|---|---|---|---|
| also_known_as | Higaisa | — → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.005 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1106 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1041 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1574.001 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1124 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1090.001 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1204.002 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1027.013 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1053.005 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1082 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1566.001 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1071.001 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1001.003 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1203 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1029 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.007 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1027.001 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1027.015 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1220 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1564.003 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1573.001 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1680 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1547.001 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1057 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1036.004 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1016 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.003 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1140 | 2021 → … | 100 | src_mitre_attck_enterprise |
技术使用
| ATT&CK | 技术 | platforms |
|---|---|---|
| T1001.003 | Protocol or Service Impersonation | — |
| T1016 | System Network Configuration Discovery | — |
| T1027.001 | Binary Padding | — |
| T1027.013 | Encrypted/Encoded File | — |
| T1027.015 | Compression | — |
| T1029 | Scheduled Transfer | — |
| T1036.004 | Masquerade Task or Service | — |
| T1041 | Exfiltration Over C2 Channel | — |
| T1053.005 | Scheduled Task | — |
| T1057 | Process Discovery | — |
| T1059.003 | Windows Command Shell | — |
| T1059.005 | Visual Basic | — |
| T1059.007 | JavaScript | — |
| T1071.001 | Web Protocols | — |
| T1082 | System Information Discovery | — |
| T1090.001 | Internal Proxy | — |
| T1106 | Native API | — |
| T1124 | System Time Discovery | — |
| T1140 | Deobfuscate/Decode Files or Information | — |
| T1203 | Exploitation for Client Execution | — |
| T1204.002 | Malicious File | — |
| T1220 | XSL Script Processing | — |
| T1547.001 | Registry Run Keys / Startup Folder | — |
| T1564.003 | Hidden Window | — |
| T1566.001 | Spearphishing Attachment | — |
| T1573.001 | Symmetric Cryptography | — |
| T1574.001 | DLL | — |
| T1680 | Local Storage Discovery | — |
别名
Higaisa
读取与复核
记录自动入库·未人工复核。置信度是写入方给出的 0–100 值，置信带按 ≥80 / 50–79 / <50 划为高 / 中 / 低；四条信任轴（合成、生命周期、置信带、佐证源数）分开呈现，不合并为单一信任分。