Higaisa

Overview

Higaisa is a threat group suspected to have South Korean origins. Higaisa has targeted government, public, and trade organizations in North Korea; however, they have also carried out attacks in China, Japan, Russia, Poland, and other nations. Higaisa was first disclosed in early 2019 but is assessed to have operated as early as 2009.

Targets

Government

Regions

China · Japan · Nepal · North Korea · Poland · Russia · Singapore · Switzerland

Capabilities

• Exploitation of public-facing / client applications — ATT&CK T1203

TTPs — 28 techniques across 7 tactics

Tools & malware (3)

PlugX · certutil · gh0st RAT

Reporting (3)

• The Return on the Higaisa APT — Singh, S. Singh, A
• New LNK attack tied to Higaisa APT discovered — Malwarebytes Threat Intelligence Team
• COVID-19 and New Year greetings: an investigation into the tools and methods used by the Higaisa group — PT ESC Threat Intelligence