Do Son 
Gomir installation via vulnerability exploitation | Image: The ENKI WhiteHat Threat Research Team
At a glance
| Actor or group | Kimsuky, a North Korea-linked group also tracked as Springtail, Thallium and APT43 |
| Activity type | Espionage, supply-chain pivoting, credential theft, Linux backdoor deployment |
| Targets or victims | Two South Korean groupware vendors and several of their downstream customers |
| Scale | Two vendors plus at least two customer environments; no victim total or financial figure published |
| Jurisdiction or law-enforcement status | No arrests or charges announced; attribution is a research assessment |
| Source | ENKI WhiteHat Threat Research Team, with earlier Gomir research from Symantec |
TL;DR
ENKI WhiteHat tracked a Kimsuky Gomir variant inside two South Korean groupware vendors between 2025 and early 2026. The group stole customer records from those vendors, then broke into the customers themselves. Two fresh Linux backdoors, BirdTroy and DriveTroy, joined the toolkit along the way.
What happened
Vendor A fell first, in November 2025. Attackers exploited a remote code execution flaw in an internet-facing mail server, then installed Gomir. Researchers say they still cannot explain how the group learned about that flaw.
Vendor B fell a month later, through an employee’s PC. The malware there was a variant of HttpTroy, first documented by Gen Digital in September 2025. Its scheduled task carried the harmless-looking name AhnlabUpdate.
From that foothold the operators added DWAgent, an open-source remote-control tool, and a yamux-based proxy. The proxy let them reach network segments that should have stayed isolated.
Two new backdoors
BirdTroy is a previously undocumented RAT built in Go. It wraps custom binary packets in Base64 and posts them as JSON. It can also switch to HTTP/3 over QUIC, which rides UDP and slips past appliances tuned for TCP traffic.
DriveTroy takes a quieter route. It hides an RC4-encrypted config at the end of its own file, then talks to a Google Drive account instead of a server. Every second it polls a command file, and it writes results back as another file.
Each Kimsuky Gomir variant still carries traces of its Windows ancestry. One command handler simply replies “Not implemented on Linux!”, a leftover from the original screenshot routine. Its proxy authentication key is the MD5 hash of the word github.
Fake login pages
Database passwords sat in hashed form, so stealing them outright proved useless. The operators therefore edited the groupware login page and shipped plaintext credentials straight to their C2. No second factor stood in the way at the time.
Who is behind it
ENKI WhiteHat attributes the campaign to Kimsuky with reasonable confidence, and it shows its working. Every C2 server presented the same default XAMPP certificate, a pattern seen in recent Kimsuky activity. The server IPs sat in ASN 19318 and ASN 26666, two ranges the group has favoured for years.
Neither signal is unique on its own. Together, however, they push the case forward. The Windows username jira in DriveTroy’s build path also appeared in an earlier Kimsuky decoy document, which suggests a shared operator or build machine.
Older work supports the lineage. Symantec described Gomir in 2024 as “structurally almost identical to GoBear”, the Windows backdoor tied to Kimsuky’s Troll Stealer campaign.
One human detail stands out. A proxy tool used the authentication key dkanehahffk, which is the Korean phrase for “nobody knows” typed on a QWERTY keyboard.
No arrests, charges or indictments have followed. Attribution here is an analytical assessment, not a legal finding.
Impact and scale
The vendors appear only as A and B, so their identities stay private. The knock-on damage matters more anyway.
In one case, investigators watched the attackers’ own Google Drive and saw command output from a second victim server. That username matched a customer directory listing uploaded the day before. Days later, the group read a customer’s email through a stolen groupware account.
The full ENKI WhiteHat analysis of the Kimsuky attack on a South Korean groupware vendor ships indicators of compromise and YARA rules for all three families. No victim count or financial loss figure has been published.
What comes next
Software vendors sit at the centre of this problem. One breach at a supplier can open dozens of customer networks.
Practical steps
- Test the external attack surface regularly, especially mail and web servers.
- Require a second factor such as TOTP on every groupware login.
- Encrypt stored customer credentials and access keys at rest.
- Separate internal management systems from production servers.
- Log all access to customer infrastructure, then review those logs.
- Hunt on Linux hosts for rogue rsyslogd, syslogd or cachemond services.
- Watch for outbound Google Drive API traffic from servers that need none.
Above all, treat cloud storage as a possible C2 channel. Each new Kimsuky Gomir variant leans harder on trusted services, and DriveTroy shows how well that trick still works.
Support Our Threat Intelligence
If you find our CVE report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
