Loading malware…
HttpTroy is a Kimsuky-associated backdoor used in espionage-oriented intrusions, particularly against South Korean targets. It has been observed as the final payload in a multistage infection chain in which an initial dropper deploys the MemLoad loader, which then decrypts and memory-loads the backdoor. Reported delivery has included spearphishing with ZIP lures themed as business documents such as VPN quotations or invoices, and related campaigns have also targeted South Korean groupware vendors and downstream customer environments.
HttpTroy is designed to provide long-term remote access and broad control over compromised Windows systems. Documented capabilities include command execution, file upload and download, screenshot capture, reverse shell functionality, in-memory loading and execution of additional payloads, process termination, and trace removal. It has also been reported to support execution of commands with system privileges through a dedicated command mechanism. Communications with command-and-control infrastructure use HTTP POST, with observed traffic obfuscated through XOR and Base64-style encoding. Samples have been described as heavily obfuscated and as using runtime API reconstruction and string-hiding techniques to complicate analysis and detection.
Persistence has been established through scheduled tasks in observed campaigns. HttpTroy has been linked to Kimsuky and to the Kimsuky-affiliated cluster Larva-25004. It also appears related in development lineage or tradecraft to other Kimsuky malware families including Gomir and BirdTroy, which share command logic or persistence patterns. The malware fits Kimsuky’s broader pattern of targeted credential theft, espionage, and sustained access operations against government, military, corporate, and supply-chain-adjacent organizations in South Korea.
2 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
The first campaign, attributed to Kimsuky, leveraged a VPN-invoice themed ZIP lure to drop a loader (“MemLoad”) and a new backdoor dubbed “HttpTroy”.
32 distinct techniques documented for this family, organized by ATT&CK tactic.
#Kimsuky, #Phishing, #SupplyChain, #Gomir, #HttpTroy
"국내 그룹웨어 대상 북한 APT 공격 분석" published by ENKI. #Kimsuky, #Phishing, #Slides, #Gomir, #HttpTroy
The first campaign, attributed to Kimsuky, leveraged a VPN-invoice themed ZIP lure to drop a loader (“MemLoad”) and a new backdoor dubbed “HttpTroy”.
"North Korean Hackers Turn JSON Services into Covert Malware Delivery Channels ... from trojanized code projects, with the lure"; "North Korean Hackers Lure Defense Engineers With Fake Jobs..."; "Contagious Interview campaign"
Persistance via systemd (root) ou crontab (non-root)
HTTPSpy is a full-featured remote access trojan that supports a wide range of capabilities to run shell commands, upload/download files, execute processes, capture screenshots, inject DLL paths into specified PID processes, and erase itself from the endpoint.
During the 2016 Ukraine Electric Power Attack, Sandworm Team used the xp_cmdshell command in MS-SQL. During the 2025 Poland Wiper Attacks, the adversaries leveraged PsExec to run cmd.exe commands on multiple victim machines. Numerous malware families and groups are described as using cmd.exe, cmd /c, Windows command shell, or command-line interfaces to execute commands, payloads, reconnaissance, persistence, cleanup, and ransomware actions.
Supporte 17 codes de commande : shell, transfert de fichiers, proxy, hibernation, etc.
Kimsuky meticulously crafts and delivers spear-phishing emails to its targets in an attempt to entice them into opening attachments.
Vendor B (décembre 2025) : spear-phishing ciblant un employé, avec installation d’un variant HttpTroy
Persistance via systemd (root) ou crontab (non-root)
Persistance via systemd (root)... se copie sous /var/log/rsyslogd
Persistance via systemd (root) ou crontab (non-root)
Persistance via systemd (root)... se copie sous /var/log/rsyslogd
These attachments often consist of compressed files containing droppers in formats such as .JSE, .EXE, .PIF, or .SCR. The filenames are consistent with the message content and are meant to convince the recipient to open the attachment.
persistance via tâche planifiée nommée AhnlabUpdate
HTTPSpy is a full-featured remote access trojan that supports a wide range of capabilities to run shell commands, upload/download files, execute processes, capture screenshots, inject DLL paths into specified PID processes, and erase itself from the endpoint.
The content repeatedly describes adversaries and malware deleting files, directories, droppers, scripts, logs, archives, staged data, and other artifacts from compromised systems, e.g., 'APT29 has used SDelete to remove artifacts from victim networks' and 'Lazarus Group malware has deleted files in various ways, including "suicide scripts" to delete malware binaries from the victim.'
HttpMalice, the latest backdoor variant of PebbleDash, emerged no later than December 2025. It comes with capabilities to gather information about the compromised system, set up persistence, perform reconnaissance using native Windows commands, capture screenshots, load downloaded payloads into memory, run commands, and exfiltrate the execution output.
T1016 — System Network Configuration Discovery (Discovery)
T1049 — System Network Connections Discovery (Discovery)
T1083 — File and Directory Discovery (Discovery)
T1113 — Screen Capture (Collection)
The first campaign, attributed to Kimsuky, leveraged a VPN-invoice themed ZIP lure...
Communication C2 via HTTPS POST ... Utilise Google Drive comme canal C2
The DLL establishes persistence on the host using a scheduled task and contacts a command-and-control (C2) server to retrieve an as-yet-unknown payload.
4H RAT has the capability to create a remote shell. AuditCred can open a reverse shell on the system to execute commands. PlugX allows actors to spawn a reverse shell on a victim. QuasarRAT can launch a remote shell to execute commands on the victim’s machine.
ADVSTORESHELL exfiltrates data over the same channel used for C2. Agrius exfiltrated staged data using tools such as Putty and WinSCP, communicating with command and control servers. AppleSeed can exfiltrate files via the C2 channel.
28 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
17 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.