Kimsuky
No sourced public emblem in this profile.
reference profile · reported nexus: KP (not nationality)
This threat actor targets South Korean think tanks, industry, nuclear power operators, and the Ministry of Unification for espionage purposes.
Source-reported aliases: Velvet Chollima, Black Banshee, Thallium, Operation Stolen Pencil, G0086, APT43, Emerald Sleet, THALLIUM, Springtail, Sparkling Pisces. Associations do not prove equivalence.
Target geography
Catalog-listed countries (associations, not attack counts): 
Germany
No bound claim-post feed for this label.
Historical casebook
No dated record curated yet; absence does not establish inactivity.
Planned Kinwilder coverage
Tentative editorial review windows, contingent on evidence and review; not promised publication dates or predictions of attacks.
No assigned review window.
References
https://securelist.com/the-kimsuky-operation-a-north-korean-apt/57915/
https://www.cfr.org/interactive/cyber-operations/kimsuky
https://youtu.be/hAsKp43AZmM?t=1027
https://www.bloomberglaw.com/document/public/subdoc/X67FPNDOUBV9VOPS35A4864BFIU?imagename=1
https://www.netscout.com/blog/asert/stolen-pencil-campaign-targets-academia
https://unit42.paloaltonetworks.com/new-babyshark-malware-targets-u-s-national-security-think-tanks/
https://attack.mitre.org/groups/G0086/
https://us-cert.cisa.gov/ncas/alerts/aa20-301a
https://www.cybereason.com/blog/back-to-the-future-inside-the-kimsuky-kgh-spyware-suite
https://mandiant.widen.net/s/zvmfw5fnjs/apt43-report
https://asec.ahnlab.com/en/57873/
https://asec.ahnlab.com/en/61082/