Malware1 associated actor

DriveTroy

Tracked since Jul 21, 2026 · Updated 3 months ago

Trending this weekNot trendingOutside this week’s top 100

Mention activity · 30 daysNo mention activity in the last 30 days.

Vulns0Associated

Actors1Associated

ATT&CK28Techniques

IOCs16Tracked

Is this in your environment?See whether this family's indicators match your telemetry and which of your assets are exposed to the CVEs associated with it.

Check your exposure

Threat actors

Associated threat actors

1 distinct threat actor Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details →

Kimsuky

Kimsuky used Gomir, BirdTroy, and DriveTroy to spread the infection across groupware developers and their clients.

via ahnlab asec blogasec.ahnlab.com

MITRE ATT&CK

Techniques & procedures

28 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

5 techniques

T1078Valid AccountsEvidence1

T1190Exploit Public-Facing ApplicationEvidence1

T1195Supply Chain CompromiseEvidence1

state-sponsored threat actors and financially motivated attackers are employing a combination of supply chain attacks... After achieving the Initial Breach through phishing, social engineering, and supply chain attacks

T1199Trusted RelationshipEvidence1

T1566PhishingEvidence1

Execution

3 techniques

T1053.003CronEvidence2

루트 권한이 아니라면 아래 과정을 거쳐 크론탭 방식으로 지속성을 확보한다. crontab -l 로 기존 내용을 읽고, */10 * * * * <자기 경로> 항목을 붙여 cron.txt 에 기록

T1059.004Unix ShellEvidence2

T1204.002Malicious FileEvidence1

Persistence

3 techniques

T1053.003CronEvidence2

T1078Valid AccountsEvidence1

T1543.002Systemd ServiceEvidence3

Persistance via systemd (root)... se copie sous /var/log/rsyslogd

Privilege Escalation

3 techniques

T1053.003CronEvidence2

T1078Valid AccountsEvidence1

T1543.002Systemd ServiceEvidence3

Persistance via systemd (root)... se copie sous /var/log/rsyslogd

Stealth

5 techniques

T1027.013Encrypted/Encoded FileEvidence2

Configuration chiffrée en RC4 ... + Base64 URL-safe, stockée en fin de fichier

T1036.004Masquerade Task or ServiceEvidence3

persistance via tâche planifiée nommée AhnlabUpdate

T1070.004File DeletionEvidence2

원본 삭제 ... crontab cron.txt 실행 cron.txt 삭제 후 재실행 ... delete | Bird_module_shell . Selfdelete | 자가 삭제 ... 06 | Die | 자가 삭제 + 종료

T1078Valid AccountsEvidence1

T1140Deobfuscate/Decode Files or InformationEvidence3

chiffrement XOR mod 255 + Base64 URL-safe

Credential Access

1 technique

T1056.003Web Portal CaptureEvidence1

Discovery

4 techniques

T1016System Network Configuration DiscoveryEvidence3

T1016 — System Network Configuration Discovery (Discovery)

T1049System Network Connections DiscoveryEvidence3

T1049 — System Network Connections Discovery (Discovery)

T1082System Information DiscoveryEvidence2

09 | Process_GetInfo | Query system information ... DriveTroy ... 00 | GetBasicInfo | Collect system information ( user , os , path )

T1083File and Directory DiscoveryEvidence1

T1083 — File and Directory Discovery (Discovery)

Lateral Movement

2 techniques

T1021Remote ServicesEvidence1

T1570Lateral Tool TransferEvidence1

Collection

3 techniques

T1005Data from Local SystemEvidence1

31 | Process_Download | Transfer a file from the victim system to the C & C server ... DriveTroy ... 03 | UploadFile | Upload a file from the victim's PC to Google Drive

T1056.003Web Portal CaptureEvidence1

T1113Screen CaptureEvidence1

T1113 — Screen Capture (Collection)

Command and Control

4 techniques

T1071.001Web ProtocolsEvidence3

Communication C2 via HTTPS POST ... Utilise Google Drive comme canal C2

T1102.002Bidirectional CommunicationEvidence3

Utilise Google Drive comme canal C2

T1132.001Standard EncodingEvidence3

Communication via paquets custom encodés en Base64

T1573.001Symmetric CryptographyEvidence3

Configuration chiffrée en RC4 ... chiffrement XOR mod 255

Exfiltration

2 techniques

T1041Exfiltration Over C2 ChannelEvidence2

31 | Process_Download | 피해 시스템에서 C & C 서버로 파일 전송 ... down | Bird_module_file . DownFile | 피해 시스템에서 C & C 서버로 파일 전송

T1567.002Exfiltration to Cloud StorageEvidence3

Utilise Google Drive comme canal C2

Indicators of compromise

Observables

16 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.

View all in app →

Indicator values are available in Mallory. Pivot on every hash, domain, URL, and IP, or pipe them straight into your SIEM.View all in Mallory

Activity feed

Recent activity

4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

View more in app →

ahnlab asec blogNews · Aug 19, 2026July 2026 Threat Trend Report on APT Groups - ASECUsed by Kimsuky to spread infections across groupware developers and their clients.Read more ↗cyberveilleNews · Jul 23, 2026Kimsuky attaque des éditeurs de groupware sud-coréens avec de nouveaux variants Gomir | CyberVeilleNew Linux backdoor written in Go that uses Google Drive as its C2 channel, polls command files at one-second intervals, stores RC4-encrypted configuration appended to the binary, and persists via systemd using masqueraded service names.Read more ↗enki blogNews · Jul 21, 2026신종 Gomir Family를 이용한 Kimsuky의 국내 그룹웨어 개발사 공격 분석 | 엔키화이트햇Go-based Linux backdoor and apparent Gomir variant that abuses Google Drive for C2. It extracts embedded configuration, uses RC4 plus URL-safe Base64 for communications, polls Google Drive for commands, uploads results, supports shell execution, file transfer, persistence, self-deletion, and connection testing.Read more ↗enki blogNews · Jul 21, 2026Analysis of Kimsuky's Attack on a South Korean Groupware Vendor Using a New Gomir Family Variant | Enki White HatGo-based Linux backdoor assessed as a newly developed Gomir variant. It stores encrypted configuration in its own file, uses Google Drive for command polling and result upload, gathers system and external IP information, executes shell commands, transfers files, establishes persistence, and can self-delete.Read more ↗

Is this in your environment?See whether this family's indicators match your telemetry and which of your assets are exposed to the CVEs associated with it.

Check your exposure

Mallory platform

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start Free Trial Open in App ↗

IOC matching16Match every observed IP, domain, and hash against your live telemetry.

Associated threat actors1Groups linked to this family, with evidence pinned to each claim.

Associated vulnerabilitiesCVEs linked to this family, with the reporting behind each link.

Detection signaturesYARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping28Every documented technique, ranked by evidence weight.

Researcher chatterReddit, Mastodon, and CTI community discussion around this family.

DriveTroy

Tracked since Jul 21, 2026 · Updated 3 months ago

Trending this weekNot trendingOutside this week’s top 100

Mention activity · 30 daysNo mention activity in the last 30 days.

Vulns0Associated

Actors1Associated

ATT&CK28Techniques

IOCs16Tracked

Is this in your environment?See whether this family's indicators match your telemetry and which of your assets are exposed to the CVEs associated with it.

Check your exposure