Analysis of Kimsuky's Attack on a South Korean Groupware Vendor Using a New Gomir Family Variant

The Kimsuky threat actor conducted a targeted campaign against South Korean groupware vendors from 2025 to early 2026. They deployed two new malware variants, BirdTroy and DriveTroy, which are evolutions of the Gomir/HttpTroy malware family. BirdTroy communicates using custom protocols and HTTP/3 (QUIC), while DriveTroy abuses Google Drive as a command-and-control channel to evade detection. Initial access was achieved through vulnerability exploitation and spear-phishing. Post-compromise activities included aggressive lateral movement, credential harvesting via tampered login pages, and the use of legitimate tools such as DWAgent for remote access and custom proxy tools for lateral movement. The campaign's attribution to Kimsuky is supported by malware characteristics, infrastructure details including default XAMPP certificates, and ASN usage consistent with prior Kimsuky operations.

The campaign enabled Kimsuky to infiltrate South Korean groupware vendors and their customers, potentially compromising sensitive communications and credentials. The use of advanced malware variants with stealthy C2 channels and legitimate tools for lateral movement increases the difficulty of detection and remediation. Credential harvesting and tampering with login pages could lead to further unauthorized access and data compromise within affected organizations.

No specific patches or fixes are indicated for this threat. Mitigation should focus on detecting and blocking the described malware behaviors and C2 channels, including monitoring for unusual HTTP/3 (QUIC) traffic and Google Drive abuse. Organizations should also be vigilant against spear-phishing attempts and secure groupware vendor environments to prevent exploitation. Since no official vendor advisory or patch is provided, check vendor communications for updates. Employing endpoint detection and response solutions capable of identifying the use of legitimate remote access tools like DWAgent in suspicious contexts may also help.