Skip to content

AppleSeed

Software · ATTACK:enterprise:S0622

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:S0622",
  "title": "AppleSeed",
  "type": "Software",
  "source_url": "https://attack.mitre.org/software/S0622",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "malware--295721d2-ee20-4fa3-ade3-37f4146b4570",
  "external_id": "S0622",
  "domain": "enterprise",
  "created": "2021-06-10T14:53:49.448Z",
  "modified": "2025-04-25T14:42:53.967Z",
  "version": "1.1",
  "aliases": [

  ],
  "tactics": [

  ],
  "source_references": [
    {
      "source_name": "Malwarebytes Kimsuky June 2021",
      "url": "https://blog.malwarebytes.com/threat-analysis/2021/06/kimsuky-apt-continues-to-target-south-korean-government-using-appleseed-backdoor/"
    }
  ]
}

Explicit source assertions (33)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:S0622 → uses → ATTACK:enterprise:T1059.007

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--06a82ed9-c3c3-412a-98f7-838442f4e1cc

Malwarebytes Kimsuky June 2021

ATTACK:enterprise:S0622 → uses → ATTACK:enterprise:T1059.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1628f41f-4941-40d7-a11c-1f345925ab6e

Malwarebytes Kimsuky June 2021

ATTACK:enterprise:S0622 → uses → ATTACK:enterprise:T1027.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2a04cfdd-a27a-498c-bbe2-8677a13811e0

Malwarebytes Kimsuky June 2021

ATTACK:enterprise:S0622 → uses → ATTACK:enterprise:T1016

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2eae8ade-1ddb-41d4-82cc-572b1158c06c

Malwarebytes Kimsuky June 2021

ATTACK:enterprise:S0622 → uses → ATTACK:enterprise:T1036

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2f249959-a448-454d-85ab-f71c8c5ff277

Malwarebytes Kimsuky June 2021

ATTACK:enterprise:S0622 → uses → ATTACK:enterprise:T1566.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3577cdd8-c9fd-4b97-94a5-6332f9cad77a

Malwarebytes Kimsuky June 2021

ATTACK:enterprise:S0622 → uses → ATTACK:enterprise:T1140

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3a6a72e8-0637-41db-b455-6b5d629aba28

Malwarebytes Kimsuky June 2021

ATTACK:enterprise:S0622 → uses → ATTACK:enterprise:T1057

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--49944838-b6f8-4e1c-94d4-5b70cb436700

Malwarebytes Kimsuky June 2021

ATTACK:enterprise:S0622 → uses → ATTACK:enterprise:T1134

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--57aa85a9-8484-4a1a-947f-3d266d2b3c7d

Malwarebytes Kimsuky June 2021

ATTACK:enterprise:S0622 → uses → ATTACK:enterprise:T1056.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5903c147-70f5-45fe-a63c-418c61566422

Malwarebytes Kimsuky June 2021 · KISA Operation Muzabi

ATTACK:enterprise:S0622 → uses → ATTACK:enterprise:T1005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--64a40a9a-ddea-430d-ab08-77c350d83497

Malwarebytes Kimsuky June 2021 · KISA Operation Muzabi

ATTACK:enterprise:S0622 → uses → ATTACK:enterprise:T1036.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--71b2b21e-bb44-47eb-85da-7a593419c0c5

Malwarebytes Kimsuky June 2021

ATTACK:enterprise:S0622 → uses → ATTACK:enterprise:T1082

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7920e962-00d7-4eb0-a94d-ed1ca196cd50

Malwarebytes Kimsuky June 2021

ATTACK:enterprise:G0094 → uses → ATTACK:enterprise:S0622

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7eb36f17-be21-4235-9a3b-736b17d089dc

Malwarebytes Kimsuky June 2021 · KISA Operation Muzabi

ATTACK:enterprise:S0622 → uses → ATTACK:enterprise:T1119

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7f1c1e43-07dc-4deb-a27f-9f140a894c51

KISA Operation Muzabi

ATTACK:enterprise:S0622 → uses → ATTACK:enterprise:T1567

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--82a28d75-1f8e-45fa-9988-af46ed102cab

KISA Operation Muzabi

ATTACK:enterprise:S0622 → uses → ATTACK:enterprise:T1030

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--909b065a-d857-48dc-9d6b-f7847bf613e6

KISA Operation Muzabi

ATTACK:enterprise:S0622 → uses → ATTACK:enterprise:T1106

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--90ae4d92-9278-4cdd-a71c-b217a8bbb86a

Malwarebytes Kimsuky June 2021

ATTACK:enterprise:S0622 → uses → ATTACK:enterprise:T1560

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--985066fb-7fbb-4147-a69d-b33d45cd3e7f

KISA Operation Muzabi

ATTACK:enterprise:S0622 → uses → ATTACK:enterprise:T1008

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--98fc2f95-0c93-405a-a54e-880622d8d233

Malwarebytes Kimsuky June 2021

ATTACK:enterprise:S0622 → uses → ATTACK:enterprise:T1041

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9ee16333-0c70-4d8a-8fc7-ab81e4fe389a

Malwarebytes Kimsuky June 2021

ATTACK:enterprise:S0622 → uses → ATTACK:enterprise:T1083

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b2c4bc70-088c-4e99-863b-65c4267c7220

Malwarebytes Kimsuky June 2021

ATTACK:enterprise:S0622 → uses → ATTACK:enterprise:T1027

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b49fe95b-bd40-4dc7-a42c-b5741cde4941

Malwarebytes Kimsuky June 2021

ATTACK:enterprise:S0622 → uses → ATTACK:enterprise:T1071.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c223714e-1321-45e2-b5e2-2b54959d340a

Malwarebytes Kimsuky June 2021 · KISA Operation Muzabi

ATTACK:enterprise:S0622 → uses → ATTACK:enterprise:T1070.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--cf36b530-36fa-40f5-b11c-94b5f5cfaf76

Malwarebytes Kimsuky June 2021

ATTACK:enterprise:S0622 → uses → ATTACK:enterprise:T1113

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d0eaa321-d917-4dee-aca4-6644ed2df1df

Malwarebytes Kimsuky June 2021 · KISA Operation Muzabi

ATTACK:enterprise:S0622 → uses → ATTACK:enterprise:T1204.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d2cf553c-b2a3-4599-9cb8-4722eb1b1293

Malwarebytes Kimsuky June 2021

ATTACK:enterprise:S0622 → uses → ATTACK:enterprise:T1074.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d747c1d7-646a-4d72-a00b-e2f10ed1f9eb

Malwarebytes Kimsuky June 2021

ATTACK:enterprise:S0622 → uses → ATTACK:enterprise:T1560.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--dfd24960-6b7e-4fab-bb84-2fc2ed4fc772

Malwarebytes Kimsuky June 2021

ATTACK:enterprise:S0622 → uses → ATTACK:enterprise:T1547.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e1cf08cf-e483-44a1-bdfe-cdfa424d69e5

Malwarebytes Kimsuky June 2021

ATTACK:enterprise:S0622 → uses → ATTACK:enterprise:T1025

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e465cb38-ba50-4d2d-b2cd-659742815317

Malwarebytes Kimsuky June 2021 · KISA Operation Muzabi

ATTACK:enterprise:S0622 → uses → ATTACK:enterprise:T1124

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ec134ae1-153b-46bb-b5f8-d1b9ac5275df

Malwarebytes Kimsuky June 2021

ATTACK:enterprise:S0622 → uses → ATTACK:enterprise:T1218.010

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ee56e02a-67c0-4c26-b643-7569de421298

Malwarebytes Kimsuky June 2021

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.