MalwareUsed by 1 actor

HelloDoor

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

Kimsuky

The group is also deploying new malware families like HelloDoor and HttpMalice, variants of PebbleDash, and enhanced versions of AppleSeed, such as HappyDoor, which focuses on data exfiltration and GPKI certificate extraction.

via scworldscworld.com

MITRE ATT&CK

Techniques & procedures

12 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1566.001Spearphishing AttachmentEvidence1

Kimsuky obtains initial access to target systems by delivering spear-phishing emails containing malicious attachments disguised as documents.

Execution

3 techniques

T1059Command and Scripting InterpreterEvidence1

HTTPSpy is a full-featured remote access trojan that supports a wide range of capabilities to run shell commands, upload/download files, execute processes, capture screenshots, inject DLL paths into specified PID processes, and erase itself from the endpoint.

T1059.001PowerShellEvidence1

The malicious payload leverages powershell.exe -windowstyle hidden certutil -decode [src path] [dst path] for the second Base64 decoding before execution.

T1204User ExecutionEvidence1

Kimsuky meticulously crafts and delivers spear-phishing emails to its targets in an attempt to entice them into opening attachments.

Persistence

1 technique

T1547.001Registry Run Keys / Startup FolderEvidence1

HelloDoor establishes persistence upon execution by registering itself to the HKCU\Software\Microsoft\Windows\CurrentVersion\Run key...

Privilege Escalation

1 technique

T1547.001Registry Run Keys / Startup FolderEvidence1

HelloDoor establishes persistence upon execution by registering itself to the HKCU\Software\Microsoft\Windows\CurrentVersion\Run key...

Stealth

3 techniques

T1027Obfuscated Files or InformationEvidence1

Reger Dropper (.SCR) and Pidoc Dropper (.PIF) also contain benign lure files and malicious payloads that, in both cases, are encrypted using XOR operations... Pidoc Dropper is fully obfuscated using dummy data and encrypted strings.

T1036MasqueradingEvidence1

These attachments often consist of compressed files containing droppers in formats such as .JSE, .EXE, .PIF, or .SCR. The filenames are consistent with the message content and are meant to convince the recipient to open the attachment.

T1218.010Regsvr32Evidence1

Ultimately, the malicious payload is executed via command-line instructions such as regsvr32.exe /s [file path]

Discovery

1 technique

T1082System Information DiscoveryEvidence1

The more recent variant gathers critical information from the compromised system, such as the current directory path, volume serial numbers, user privileges, username, local IP address...

Command and Control

3 techniques

T1071.001Web ProtocolsEvidence1

The implant communicates with the C2 server ... over the HTTP protocol.

T1090.002External ProxyEvidence1

it is noteworthy that HelloDoor employs a C2 server hosted through TryCloudflare... they actively leverage tunneling services such as Cloudflare Quick Tunnels, VSCode Tunneling, and Ngrok to hide their infrastructure.

T1105Ingress Tool TransferEvidence1

The DLL establishes persistence on the host using a scheduled task and contacts a command-and-control (C2) server to retrieve an as-yet-unknown payload.

INDICATORS OF COMPROMISE

IOCs tracked for this family

2 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Hashes

2 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

hash.md5●●●●●●●●●●●●View more in app5 years ago

ACTIVITY FEED

Recent activity

3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

3 SOURCESView more in app

scworldNews

May 29, 2026

North Korean hackers Kimsuky target South Korea with new malware variants | brief | SC Media

New malware family deployed by Kimsuky as part of its evolving intrusion toolkit.

the hacker newsNews

May 29, 2026

Kimsuky Deploys HTTPSpy, Expands Arsenal with HelloDoor and VS Code Tunnels

A Rust-based PebbleDash backdoor variant with basic command execution capability, directory control, and sleep timing functions.

securelistNews

May 13, 2021

Disclosing new PebbleDash-based tools by Kimsuky | Securelist

A Rust-based DLL backdoor in the PebbleDash cluster. It establishes persistence via the Run registry key, communicates over HTTP with a TryCloudflare-hosted C2, generates a host identifier from device information, decrypts commands with RC4, and supports directory changes, sleep, persistence installation, and command execution.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching2

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping12

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

MalwareUsed by 1 actor

HelloDoor

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

Kimsuky

via scworldscworld.com

MITRE ATT&CK

Techniques & procedures

12 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1566.001Spearphishing AttachmentEvidence1

Kimsuky obtains initial access to target systems by delivering spear-phishing emails containing malicious attachments disguised as documents.

Execution

3 techniques

T1059Command and Scripting InterpreterEvidence1

T1059.001PowerShellEvidence1

The malicious payload leverages powershell.exe -windowstyle hidden certutil -decode [src path] [dst path] for the second Base64 decoding before execution.

T1204User ExecutionEvidence1

Kimsuky meticulously crafts and delivers spear-phishing emails to its targets in an attempt to entice them into opening attachments.

Persistence

1 technique

T1547.001Registry Run Keys / Startup FolderEvidence1

HelloDoor establishes persistence upon execution by registering itself to the HKCU\Software\Microsoft\Windows\CurrentVersion\Run key...

Privilege Escalation

1 technique

T1547.001Registry Run Keys / Startup FolderEvidence1

HelloDoor establishes persistence upon execution by registering itself to the HKCU\Software\Microsoft\Windows\CurrentVersion\Run key...

Stealth

3 techniques

T1027Obfuscated Files or InformationEvidence1

T1036MasqueradingEvidence1

T1218.010Regsvr32Evidence1

Ultimately, the malicious payload is executed via command-line instructions such as regsvr32.exe /s [file path]

Discovery

1 technique

T1082System Information DiscoveryEvidence1

The more recent variant gathers critical information from the compromised system, such as the current directory path, volume serial numbers, user privileges, username, local IP address...

Command and Control

3 techniques

T1071.001Web ProtocolsEvidence1

The implant communicates with the C2 server ... over the HTTP protocol.

T1090.002External ProxyEvidence1

T1105Ingress Tool TransferEvidence1

The DLL establishes persistence on the host using a scheduled task and contacts a command-and-control (C2) server to retrieve an as-yet-unknown payload.

INDICATORS OF COMPROMISE

IOCs tracked for this family

2 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Hashes

2 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

hash.md5●●●●●●●●●●●●View more in app5 years ago

ACTIVITY FEED

Recent activity

3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

3 SOURCESView more in app

scworldNews

May 29, 2026

North Korean hackers Kimsuky target South Korea with new malware variants | brief | SC Media

New malware family deployed by Kimsuky as part of its evolving intrusion toolkit.

the hacker newsNews

May 29, 2026

Kimsuky Deploys HTTPSpy, Expands Arsenal with HelloDoor and VS Code Tunnels

A Rust-based PebbleDash backdoor variant with basic command execution capability, directory control, and sleep timing functions.

securelistNews

May 13, 2021

Disclosing new PebbleDash-based tools by Kimsuky | Securelist

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching2

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping12

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.