Loading story…
Kimsuky targeted a South Korean groupware vendor in an intrusion that researchers linked to a new Gomir malware family variant, adding to evidence of supply-chain-focused activity against software providers. ENKI reported that the campaign involved Linux-targeting, Go-based backdoors and highlighted overlap with HttpTroy-related tradecraft, while social reporting on the incident described the operation as combining phishing and supply-chain elements.
The analysis tied the intrusion to three closely related backdoors—Gomir, BirdTroy, and DriveTroy—that share persistence logic, command structures, and operator behavior. Gomir was described as a Linux variant of GoBear RAT using HTTPS POST communications, custom encoding and encryption, and systemd or cron persistence; BirdTroy reused Gomir persistence code while adding HTTP and HTTP/3 QUIC transport; and DriveTroy used embedded OAuth credentials to exchange host data and task files through Google Drive. ENKI said the report includes C2 infrastructure, malware hashes, embedded credentials, and YARA detection rules for all three families.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
ENKI WhiteHat said Kimsuky targeted South Korean collaborative-work software vendors in 2025 and early 2026, compromising one via a mail-server RCE flaw and another through employee social engineering. The attackers then used those vendor breaches to access customer environments, stole customer server information, tampered with login pages to harvest credentials, and reached at least one SaaS customer.
ENKI published an analysis stating that Kimsuky attacked a South Korean groupware vendor using a new Gomir-family malware variant. The report also described related Linux backdoors including Gomir, BirdTroy, and DriveTroy, and provided infrastructure, hashes, and YARA rules.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
7 references tracked. Mallory keeps watching after this page renders.
cyberveille.ch
Open sourcescworld.com
Open sourcetherecord.media
Open sourcebsky.app
Open sourceenki.co.kr
Open sourcebsky.app
Open sourceenki.co.kr
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
North Korea-aligned threat actor **Kimsuky** has expanded operations across its **AppleSeed** and **PebbleDash** intrusion clusters, using spear-phishing documents to gain initial access and then deploying a broader malware set that includes **HelloDoor**, **httpMalice**, **MemLoad**, **httpTroy**, **AppleSeed**, and **HappyDoor**. Researchers assess with medium-high confidence that both clusters are operated by Kimsuky-affiliated actors, also tracked as **APT43** and **Ruby Sleet**, with AppleSeed showing a stronger focus on government organizations while PebbleDash activity has also reached defense-related entities in Brazil and Germany in addition to South Korean targets. The campaigns show a notable shift in post-compromise tradecraft, with operators increasingly abusing legitimate remote administration and tunneling tools such as **VSCode Remote Tunneling**, **DWAgent**, and **Cloudflare Quick Tunnels** for persistence and access. The report also notes malware development changes including the use of **Rust**, probable LLM-assisted code comments, and continued reliance on infrastructure patterns tied to free South Korean hosting domains and compromised South Korean websites, indicating that Kimsuky is modernizing its tooling while preserving long-standing operational habits.
Jun 29, 2026
Researchers reported a malicious Windows shortcut file, `[별첨2]_인지시점_정정신고_추가_증적자료_FAQ.lnk`, as likely tied to the North Korean threat actor **Kimsuky**. The lure appears crafted for administrative and oversight functions including insurance, finance, security, audit, legal, and general affairs teams, indicating a targeted phishing effort aimed at organizations handling sensitive internal records and compliance material. Separate reporting highlighted an ENKI presentation analyzing North Korean APT attacks against domestic groupware environments and linked the activity to **Kimsuky** phishing operations, with references to malware and tooling including **Gomir** and **HttpTroy**. Together, the reports point to an ongoing espionage campaign in which Kimsuky uses socially engineered document-themed lures and groupware-focused intrusion tactics to reach organizational staff and compromise enterprise communications workflows.
Jul 28, 2026
The North Korean threat actor Kimsuky has been identified distributing a new backdoor, codenamed **HttpTroy**, in a targeted spear-phishing campaign against a South Korean victim. The attack leveraged a phishing email containing a ZIP file disguised as a VPN invoice, which, when opened, initiated a multi-stage infection chain involving a dropper, a loader (`MemLoad`), and the final **HttpTroy** backdoor. The malware is capable of file transfer, screenshot capture, command execution with elevated privileges, in-memory loading of executables, reverse shell access, process termination, and trace removal. Persistence is established via a scheduled task impersonating the South Korean cybersecurity company AhnLab, and communication with the command-and-control server is conducted over HTTP POST requests. **HttpTroy** employs advanced obfuscation techniques, including custom API hashing and string obfuscation using XOR and SIMD instructions, to evade detection and analysis. The campaign highlights the continued evolution of North Korean APT toolsets, with Kimsuky adopting stealthier malware to enhance their cyber-espionage capabilities. Security researchers have emphasized the sophistication of the infection chain and the backdoor's ability to provide attackers with full control over compromised systems.
Jun 29, 2026