North Korea–linked APT Kimsuky behind quishing attacks, FBI warns

The FBI warns that the North Korea–linked APT group Kimsuky is targeting governments, think tanks and academic institutions with quishing attacks. According to FBI, as of 2025 Kimsuky actors have targeted think tanks, academic institutions, and both U.S. and foreign government entities with embedded malicious Quick Response codes in spearphishing campaigns. Quishing campaigns commonly deliver QR images as email attachments or embedded graphics, evading URL inspection and sandboxing.

In May 2025, Kimsuky actors spoofed a foreign advisor in an email requesting insight from a think tank leader, with a QR code to access a questionnaire. In June 2025, they sent a strategic advisory firm a spearphishing email inviting recipients to a non-existent conference, directing to a registration landing page and then a fake Google account login page to harvest credentials.

The campaigns also involved exploiting an RDP vulnerability (BlueKeep, CVE-2019-0708) and the Microsoft Office Equation Editor vulnerability (CVE-2017-11882) to gain initial access and distribute malware.