Larva 25004

Larva-25004 is a North Korea-affiliated intrusion set linked to Kimsuky and associated with espionage activity against South Korean organizations. The group has been observed using phishing emails carrying archive attachments to gain initial access, followed by a multi-stage malware chain involving a dropper, an in-memory loader, and the HttpTroy backdoor. HttpTroy provides broad remote access capabilities including command execution, file transfer, screenshot capture, and sustained operator control of compromised systems. The actor’s tradecraft reflects Kimsuky-style operational patterns, including layered infection chains, strong use of obfuscation and encryption, and abuse of legitimate system mechanisms for concealment and persistence. Reported techniques include RC4-encrypted and XOR-obfuscated payload handling, HTTP-based command-and-control, and persistence through scheduled task abuse. The group’s operations indicate a focus on covert long-term access, post-compromise surveillance, and data theft rather than disruptive or financially motivated activity. Larva-25004 should be understood as a Kimsuky-linked cluster rather than a broadly independent brand. Its known activity aligns with North Korean state-directed cyber espionage targeting South Korean entities, with emphasis on stealth, persistence, and full-system remote administration.