Bleepingcomputer

FBI Alerts on Kimsuky Hackers Using QR Codes for Phishing Attacks

First seen 9 Jan 2026, 11:48 UTC • Bleepingcomputer

+11 •34.8

Article Content

Include sub-articles 1 / 1

Browse articles

ThreatCluster

The FBI has issued a warning about the North Korean hacker group Kimsuky employing malicious QR codes in spear-phishing campaigns targeting U.S. organizations. The attacks focus on entities involved in North Korea-related policy, including think tanks, academic institutions, and government agencies, with incidents reported in May and June 2025.

How this analysis works

Attack Flow

16 entities, 42 inferred relationships (STIX 2.1).

Threat Actor (4)

Apt43
Kimsuki
Kimsuky
Konni

Technique (5)

Phishing
T1566.001 - Spearphishing Attachment
T1566.002 - Spearphishing Link
T1566 - Phishing
T1566 - Spearphishing

Campaign (1)

Quishing

Organization (2)

Google
Okta

Affected Platform (2)

Android
Microsoft 365

Tool (2)

Find My Device
VPN

Relationships

Apt43 uses Find My Device
Apt43 uses VPN
Kimsuki uses Find My Device
Kimsuki uses VPN
Kimsuky uses Find My Device
Kimsuky uses VPN
Konni uses Find My Device
Konni uses VPN
Apt43 uses Phishing
Apt43 uses T1566.001 - Spearphishing Attachment
Apt43 uses T1566.002 - Spearphishing Link
Apt43 uses T1566 - Phishing
Apt43 uses T1566 - Spearphishing
Kimsuki uses Phishing
Kimsuki uses T1566.001 - Spearphishing Attachment
Kimsuki uses T1566.002 - Spearphishing Link
Kimsuki uses T1566 - Phishing
Kimsuki uses T1566 - Spearphishing
Kimsuky uses Phishing
Kimsuky uses T1566.001 - Spearphishing Attachment
Kimsuky uses T1566.002 - Spearphishing Link
Kimsuky uses T1566 - Phishing
Kimsuky uses T1566 - Spearphishing
Konni uses Phishing
Konni uses T1566.001 - Spearphishing Attachment
Konni uses T1566.002 - Spearphishing Link
Konni uses T1566 - Phishing
Konni uses T1566 - Spearphishing
Quishing attributed to Apt43
Quishing attributed to Kimsuki
Quishing attributed to Kimsuky
Quishing attributed to Konni
Apt43 targets Google
Apt43 targets Okta
Kimsuki targets Google
Kimsuki targets Okta
Kimsuky targets Google
Kimsuky targets Okta
Konni targets Google
Konni targets Okta
Apt43 related to Android
Apt43 related to Microsoft 365

Continue Reading

Kimsuky Expands AI Capabilities for Cyberattacks Kimsuky Exploits South Korean Groupware Vendors with New Gomir Variants Kimsuky Group Leverages AI for Malware Targeting South Korean Government Microsoft Mitigates Windows LNK Vulnerability Exploited in Zero-Day Attacks New Techniques Discovered for Abusing Windows LNK Files

FBI Alerts on Kimsuky Hackers Using QR Codes for Phishing Attacks

Article Content

More articles in this cluster

Attack Flow

Defensive Countermeasures

Extracted Entities

Continue Reading