Higaisa
- ID
- G0126
- Source
- attack.mitre.org
- MITRE last modified
- 1 Aug 2026
Higaisa is a threat group suspected to have South Korean origins. Higaisa has targeted government, public, and trade organizations in North Korea; however, they have also carried out attacks in China, Japan, Russia, Poland, and other nations. Higaisa was first disclosed in early 2019 but is assessed to have operated as early as 2009.[1][2][3]
Techniques used (28)
- T1001.003 Protocol or Service Impersonation
- T1016 System Network Configuration Discovery
- T1027.001 Binary Padding
- T1027.013 Encrypted/Encoded File
- T1027.015 Compression
- T1029 Scheduled Transfer
- T1036.004 Masquerade Task or Service
- T1041 Exfiltration Over C2 Channel
- T1053.005 Scheduled Task
- T1057 Process Discovery
- T1059.003 Windows Command Shell
- T1059.005 Visual Basic
- T1059.007 JavaScript
- T1071.001 Web Protocols
- T1082 System Information Discovery
- T1090.001 Internal Proxy
- T1106 Native API
- T1124 System Time Discovery
- T1140 Deobfuscate/Decode Files or Information
- T1203 Exploitation for Client Execution
- T1204.002 Malicious File
- T1220 XSL Script Processing
- T1547.001 Registry Run Keys / Startup Folder
- T1564.003 Hidden Window
- T1566.001 Spearphishing Attachment
- T1573.001 Symmetric Cryptography
- T1574.001 DLL
- T1680 Local Storage Discovery