Loading story…
The North Korean threat actor Kimsuky has been identified distributing a new backdoor, codenamed HttpTroy, in a targeted spear-phishing campaign against a South Korean victim. The attack leveraged a phishing email containing a ZIP file disguised as a VPN invoice, which, when opened, initiated a multi-stage infection chain involving a dropper, a loader (MemLoad), and the final HttpTroy backdoor. The malware is capable of file transfer, screenshot capture, command execution with elevated privileges, in-memory loading of executables, reverse shell access, process termination, and trace removal. Persistence is established via a scheduled task impersonating the South Korean cybersecurity company AhnLab, and communication with the command-and-control server is conducted over HTTP POST requests.
HttpTroy employs advanced obfuscation techniques, including custom API hashing and string obfuscation using XOR and SIMD instructions, to evade detection and analysis. The campaign highlights the continued evolution of North Korean APT toolsets, with Kimsuky adopting stealthier malware to enhance their cyber-espionage capabilities. Security researchers have emphasized the sophistication of the infection chain and the backdoor's ability to provide attackers with full control over compromised systems.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
North Korea-linked Lazarus was reported to be using a new variant of the BLINDINGCAN remote access trojan, indicating an upgrade in the group's malware toolkit. The available references present this as a separate development from the Kimsuky HttpTroy activity.
North Korea-linked Kimsuky began a targeted cyberattack campaign against South Korea users using a new HttpTroy backdoor, including lures disguised as a VPN-related invoice. The reporting describes HttpTroy as a stealthy new addition to the group's malware arsenal.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
darkreading.com
Open sourcesecurityonline.info
Open sourcethehackernews.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
North Korea-aligned threat actor **Kimsuky** has expanded operations across its **AppleSeed** and **PebbleDash** intrusion clusters, using spear-phishing documents to gain initial access and then deploying a broader malware set that includes **HelloDoor**, **httpMalice**, **MemLoad**, **httpTroy**, **AppleSeed**, and **HappyDoor**. Researchers assess with medium-high confidence that both clusters are operated by Kimsuky-affiliated actors, also tracked as **APT43** and **Ruby Sleet**, with AppleSeed showing a stronger focus on government organizations while PebbleDash activity has also reached defense-related entities in Brazil and Germany in addition to South Korean targets. The campaigns show a notable shift in post-compromise tradecraft, with operators increasingly abusing legitimate remote administration and tunneling tools such as **VSCode Remote Tunneling**, **DWAgent**, and **Cloudflare Quick Tunnels** for persistence and access. The report also notes malware development changes including the use of **Rust**, probable LLM-assisted code comments, and continued reliance on infrastructure patterns tied to free South Korean hosting domains and compromised South Korean websites, indicating that Kimsuky is modernizing its tooling while preserving long-standing operational habits.
Jun 29, 2026
North Korean state-backed threat group **Kimsuky** has been linked to an ongoing spear-phishing campaign targeting organizations and individuals in the United States, Europe, and Asia, including think tanks, research universities, government entities, and staff at Korea Risk Group. Researchers said the operation uses tailored phishing emails and **OneDrive-hosted password-protected documents** containing malicious Microsoft Office macros to gain initial access. The campaign delivers a new reconnaissance malware component dubbed **ReconShark**, assessed as an evolved variant of BabyShark. ReconShark gathers host data including running processes, battery status, and installed security products, then exfiltrates the information via HTTP `POST` requests without first writing it to disk. Based on the victim environment, the malware can also deploy follow-on payloads such as VBS, HTA, batch scripts, DLLs, malicious Office templates, and modified LNK files; supporting infrastructure was identified on NameCheap-hosted shared servers tied to domains including `yonsei[.]lol`, `rfa[.]ink`, `mitmail[.]tech`, and `newshare[.]online`.
Jun 29, 2026
North Korea-linked threat group **Kimsuky** has been reported using malicious Windows shortcut (`.LNK`) files to initiate a **multi-stage infection chain** that ends with deployment of a **Python-based backdoor**. Reporting shared from both AhnLab and Excalibra indicates the campaign relies on weaponized LNK files as the initial access vector, with the malware delivery process evolving from earlier distribution patterns. The activity was attributed to Kimsuky in threat-intelligence reporting and social media amplification, with references also linking the cluster to **DPRK** operations and possible overlap or comparison with **Konni** tracking. While the cited summaries did not include victimology or technical indicators, they consistently described a shift in how the group distributes malware and highlighted the use of LNK-based social engineering to stage follow-on payloads.
Jun 30, 2026