Gold Open Source
ExplorePackagesVulnerabilitiesCWEsMCP ServersScan
Login
Gold Open Source

The authoritative source for production-ready open-source components. Every package, container image, AI model, and MCP server undergoes rigorous verification for security, malware, and license compliance.

Explore Gold

  • Explore Everything
  • Packages
  • Gold Certified Packages
  • Container Images
  • AI Models
  • MCP Servers
  • Agent Skills
  • Chip Manufacturers

Security Data & Tools

  • Scan Your Dependencies
  • Trending Threats
  • Threat RSS Feeds
  • CVE Database
  • Actively Exploited (KEV)
  • SGZ Zero-Days
  • CWE Index
  • MITRE ATT&CK
  • Malicious Packages
  • Security Glossary
  • Supply-Chain Report
  • Developers (API & Badge)
  • Chrome Extension
  • Credits & Data Sources

Products

  • The Platform
  • ESSCM
  • Portal
  • TPRM
  • OSM
  • Cowork
  • Code / Runner
  • Guard

Use Cases

  • Know Your Software
  • Auto-Fix Vulnerabilities
  • Asset Discovery
  • AI Governance
  • MCP Server Security
  • Supply Chain Compliance
  • Zero-Day Discovery
  • All Use Cases

Company

  • About
  • Pricing
  • Blog
  • Documentation
  • Safeguard Academy
  • Contact
  • Privacy Policy
  • Terms of Service

© 2026 Gold Open Source. All rights reserved.

Built with care bySafeguard
Home/ATT&CK/Software/S0622
MITRE ATT&CK Malware

AppleSeed (S0622)

ShareXLinkedInRedditHN

[AppleSeed](https://attack.mitre.org/software/S0622) is a backdoor that has been used by [Kimsuky](https://attack.mitre.org/groups/G0094) to target South Korean government, academic, and commercial targets since at least 2021.(Citation: Malwarebytes Kimsuky June 2021)

Platforms: Windows, Android

▪Techniques implemented (32)

T1059.007JavaScriptT1059.001PowerShellT1027.002Software PackingT1016System Network Configuration DiscoveryT1036MasqueradingT1566.001Spearphishing AttachmentT1140Deobfuscate/Decode Files or InformationT1057Process DiscoveryT1134Access Token ManipulationT1056.001KeyloggingT1005Data from Local SystemT1036.005Match Legitimate Resource Name or LocationT1082System Information DiscoveryT1119Automated CollectionT1567Exfiltration Over Web ServiceT1030Data Transfer Size LimitsT1106Native APIT1560Archive Collected DataT1008Fallback ChannelsT1041Exfiltration Over C2 ChannelT1083File and Directory DiscoveryT1027Obfuscated Files or InformationT1071.001Web ProtocolsT1070.004File DeletionT1113Screen CaptureT1204.002Malicious FileT1074.001Local Data StagingT1560.001Archive via UtilityT1547.001Registry Run Keys / Startup FolderT1025Data from Removable MediaT1124System Time DiscoveryT1218.010Regsvr32

▪Used by groups (1)

G0094Kimsuky
S0622on MITRE ATT&CK →

MITRE ATT&CK® is a registered trademark of The MITRE Corporation. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.