H3XA — Operational Evidence

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[AppleSeed](https://attack.mitre.org/software/S0622) is a backdoor that has been used by [Kimsuky](https://attack.mitre.org/groups/G0094) to target South Korean government, academic, and commercial targets since at least 2021.(Citation: Malwarebytes Kimsuky June 2021)

Labels

malware

33 recorded

Relationships

uses

to Access Token Manipulation

Technique

uses

to Archive Collected Data

Technique

uses

to Archive via Utility

Technique

uses

to Automated Collection

Technique

uses

to Data from Local System

Technique

uses

to Data from Removable Media

Technique

uses

to Data Transfer Size Limits

Technique

uses

to Deobfuscate/Decode Files or Information

Technique

uses

to Exfiltration Over C2 Channel

Technique

uses

to Exfiltration Over Web Service

Technique

uses

to Fallback Channels

Technique

uses

to File and Directory Discovery

Technique

uses

to File Deletion

Technique

uses

Technique

uses

Technique

uses

to Local Data Staging

Technique

uses

to Malicious File

Technique

uses

to Masquerading

Technique

uses

to Match Legitimate Resource Name or Location

Technique

uses

Technique

uses

to Obfuscated Files or Information

Technique

uses

Technique

uses

to Process Discovery

Technique

uses

to Registry Run Keys / Startup Folder

Technique

uses

Technique

uses

to Screen Capture

Technique

uses

to Software Packing

Technique

uses

to Spearphishing Attachment

Technique

uses

to System Information Discovery

Technique

uses

to System Network Configuration Discovery

Technique

uses

to System Time Discovery

Technique

uses

to Web Protocols

Technique

uses

Group

2 external

References

mitre-attack

S0622

Malwarebytes Kimsuky June 2021

https://blog.malwarebytes.com/threat-analysis/2021/06/kimsuky-apt-continues-to-target-south-korean-government-using-appleseed-backdoor/