Akdoor

Akdoor is a Windows backdoor associated with North Korean threat activity, including operations attributed to Lazarus, and has also been referenced in relation to Kimsuky-linked delivery chains through vendor detection naming. It has been observed in targeted intrusions against South Korean organizations, including defense-sector entities and other domestic companies, where operators used modified or injected DLL components rather than conventional standalone malware.

Akdoor has been identified in campaigns where attackers injected a malicious DLL into legitimate signed software to execute within a trusted process and retrieve additional payloads from attacker-controlled infrastructure. Related activity shows process-aware branching logic, staged downloading of follow-on malware, and use of in-memory execution. Separate Akdoor-attributed samples were embedded in tampered DLL libraries derived from legitimate components such as graphics, XML, plugin, and filesystem-related libraries. These variants altered or added exported functions, sometimes operated as Windows services, and depended on specific arguments, alternate data streams, or companion data files to decrypt and launch embedded PE payloads in memory before initiating command-and-control communications.

The malware’s tradecraft emphasizes defense evasion and modular post-compromise flexibility. Observed variants hid execution material in alternate data streams, used external encrypted data blobs and keys, and changed behavior based on runtime inputs. Some samples were packed to hinder analysis, while others were designed to appear benign during superficial inspection because much of the original legitimate library code remained intact. This architecture allowed operators to swap payload logic and command-and-control information without replacing the visible host component.

Akdoor has been linked to broader Lazarus intrusion clusters targeting South Korean industry, including defense and chemical-related organizations, and overlaps have been noted with tooling associated with the NukeSped or Manuscrypt ecosystem. A related malware family, AkdoorTea, has been described as sharing commonalities with Akdoor and appearing in recruiter-themed social-engineering campaigns targeting software developers. Across reporting, Akdoor is best characterized as a Windows backdoor used in targeted espionage-oriented operations, often as one stage within a larger multi-component intrusion set.