Kimsuky Hit South Korean Groupware Vendor With New Gomir Malware Variant
Threat Actor Intelligence · 7 sources · Updated 3mo ago · First seen Jul 21, 2026
Kimsuky targeted a South Korean groupware vendor in an intrusion that researchers linked to a new Gomir malware family variant, adding to evidence of supply-chain-focused activity against software providers. ENKI reported that the campaign involved Linux-targeting, Go-based backdoors and highlighted overlap with HttpTroy-related tradecraft, while social reporting on the incident described the operation as combining phishing and supply-chain elements.
The analysis tied the intrusion to three closely related backdoors—Gomir, BirdTroy, and DriveTroy—that share persistence logic, command structures, and operator behavior. Gomir was described as a Linux variant of GoBear RAT using HTTPS POST communications, custom encoding and encryption, and systemd or cron persistence; BirdTroy reused Gomir persistence code while adding HTTP and HTTP/3 QUIC transport; and DriveTroy used embedded OAuth credentials to exchange host data and task files through Google Drive. ENKI said the report includes C2 infrastructure, malware hashes, embedded credentials, and YARA detection rules for all three families.
