MalwarePublished 10 Jul 2025Updated 9 Aug 2025

Analysis of APT-C-55 (Kimsuky) Organization's HappyDoor Backdoor Attack Based on VMP Strong Shell

Source AlienVault OTX General

Description

The APT-C-55 (Kimsuky) group, a North Korean threat actor, has launched a new attack campaign targeting South Korea. They used a disguised Bandizip installation package to deliver malicious code and a VMP-protected HappyDoor trojan for espionage activities. The attack involves remote script loading, multi-stage malware deployment, and information theft. The malware collects sensitive data, including user information, system details, and files from specific directories. It also implements keylogging, screen capture, and mobile device monitoring functionalities. The attack methodology and infrastructure align with Kimsuky's historical patterns, including the use of similar scripts, backdoor families, and domain naming conventions.

Impact

For European organizations, the direct impact of this threat is currently limited given the campaign’s focus on South Korea. However, the espionage capabilities of HappyDoor, including keylogging, screen capture, and mobile device monitoring, pose significant risks if the malware or similar variants spread to European targets. Sensitive data theft could compromise intellectual property, confidential communications, and personal data, leading to reputational damage, regulatory penalties under GDPR, and operational disruptions. The use of strong obfuscation and multi-stage deployment complicates detection and incident response efforts, potentially allowing prolonged undetected access. European organizations with business ties or partnerships in South Korea or those using Bandizip or similar software could be at elevated risk. Additionally, sectors such as government, defense, critical infrastructure, and technology firms are particularly vulnerable to espionage-focused APTs. The campaign’s sophisticated persistence and evasion techniques could enable attackers to establish long-term footholds, increasing the risk of lateral movement and broader network compromise.

Defensive guidance

1. Implement strict software supply chain validation and verify the authenticity of installation packages, especially for utilities like Bandizip. 2. Deploy advanced endpoint detection and response (EDR) solutions capable of detecting obfuscated malware and behavioral anomalies such as unusual script execution and remote script loading. 3. Monitor network traffic for connections to suspicious domains and IP addresses associated with the campaign (e.g., d.appz.p-e.kr, mrasis.n-e.kr, u.appw.p-e.kr, and IP 67.217.62.222). 4. Enforce application whitelisting and restrict execution of unauthorized scripts and binaries. 5. Conduct regular threat hunting exercises focusing on MITRE ATT&CK techniques used by Kimsuky, including process injection, scheduled tasks, and data staging activities. 6. Harden systems by disabling unnecessary services and restricting registry and file system permissions to limit malware persistence mechanisms. 7. Educate users about the risks of installing software from unverified sources and implement multi-factor authentication to reduce credential theft impact. 8. Maintain up-to-date backups and incident response plans tailored to espionage and APT scenarios. 9. Collaborate with threat intelligence sharing communities to stay informed about emerging indicators and TTPs related to Kimsuky and similar actors.

Indicators of compromise

Domains 3

d.appz.p-e.kr
mrasis.n-e.kr
u.appw.p-e.kr

IP addresses 1

67.217.62.222

Hashes 9

07fbf46d3a595a6f82e477ed4571294b
16d30316a6b700c78d021df5758db775
a6598bbdc947286c84f951289d14425c
d1ec20144c83bba921243e72c517da5e
f4cd4449e556b0580c2282fec1ca661f
01e61842e05579a4cee0dd67376ad4e09d38fcf7
07c7cf4441254e8754aa62150bf8c5365c3825f4
5f23b1ca43f6a18e3c9f21d390f5d1e187b1339b07a1dce70f8338f3be320878
d75eae7a38df433a4ac5faca0c70a1634729d884e45d14d306b2078fe0a8e5af

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 10 Jul 2025, 22:16 UTC

MITRE ATT&CK techniques16 from threat tags

Technical details

Indicators of compromise

Domains 3

IP addresses 1

Hashes 9

Community reviews

Related threats