MalwarePublished 3 Nov 2025

DPRK's Playbook: HttpTroy and New BLINDINGCAN Variant

Source AlienVault OTX General

Description

North Korean threat actors Kimsuky and Lazarus have deployed new sophisticated malware toolsets named HttpTroy and an upgraded BLINDINGCAN variant. HttpTroy is a backdoor delivered via a VPN invoice-themed attack, involving a dropper and loader (MemLoad), granting extensive system control. Lazarus's upgraded BLINDINGCAN is delivered through a new Comebacker malware variant, targeting victims in Canada. Both toolsets use advanced obfuscation, stealth techniques, and layered evasion to avoid detection. These attacks highlight DPRK's evolving cyber espionage capabilities. Although currently observed targeting South Korea and Canada, European organizations could be at risk due to geopolitical tensions and similar attack methodologies. No known exploits in the wild have been reported yet. Mitigation requires targeted detection of these toolsets, network monitoring for associated indicators, and enhanced endpoint defenses. The threat is assessed as medium severity due to its espionage focus, stealth, and complexity, but limited current scope and no public CVSS score.

Impact

For European organizations, the impact of these toolsets could be significant if targeted, especially for entities involved in geopolitical, defense, or diplomatic sectors. The HttpTroy backdoor and upgraded BLINDINGCAN provide attackers with persistent remote access, enabling data exfiltration, espionage, and potential disruption of critical systems. The stealth and obfuscation techniques increase the likelihood of prolonged undetected presence, raising risks of intellectual property theft and compromise of sensitive information. Although current targeting is focused on South Korea and Canada, European organizations with VPN infrastructure or similar network configurations could be vulnerable to similar social engineering lures. The espionage nature of the malware suggests that confidentiality and integrity of data are primary concerns, with availability less directly impacted but still at risk if attackers escalate privileges or deploy additional payloads. The evolving DPRK tactics underscore the need for vigilance against sophisticated nation-state threats in Europe, particularly in countries with strategic importance or active geopolitical roles.

Defensive guidance

European organizations should implement targeted detection and response strategies focusing on the identified indicators of compromise (IOCs) such as the provided hashes, IP addresses, URLs, and domains. Network monitoring should include anomaly detection for unusual VPN invoice-themed phishing attempts and suspicious loader behaviors like MemLoad. Endpoint detection and response (EDR) solutions must be tuned to detect obfuscated code execution and multi-stage payloads characteristic of HttpTroy and BLINDINGCAN. Employ strict network segmentation and least privilege principles to limit lateral movement if compromise occurs. Regular threat hunting exercises should incorporate these new toolsets' signatures and TTPs. User awareness training should emphasize vigilance against social engineering attacks involving VPN or invoice themes. Additionally, organizations should collaborate with national cybersecurity centers to share threat intelligence and receive updates on DPRK threat actor activities. Given the lack of patches, proactive detection and containment are critical. Finally, review and harden VPN configurations and access controls to reduce attack surface.

Summary

Recent intelligence reveals two new malware toolsets attributed to North Korean threat groups Kimsuky and Lazarus, illustrating DPRK's advancing cyber capabilities. Kimsuky deployed HttpTroy, a backdoor delivered through a VPN invoice-themed phishing attack targeting a South Korean victim. The attack chain includes a dropper that installs a loader named MemLoad, which subsequently deploys the HttpTroy backdoor. HttpTroy provides extensive remote control over compromised systems, enabling espionage activities. Lazarus introduced an upgraded BLINDINGCAN remote access tool variant, distributed via a new Comebacker malware variant, with observed targeting in Canada. Both toolsets employ sophisticated obfuscation and stealth techniques, including layered code execution and evasion mechanisms, complicating detection and analysis. Indicators include multiple malware hashes, IP addresses, URLs, and domains used for command and control. The attacks demonstrate DPRK's adaptive playbook, leveraging social engineering, multi-stage payloads, and stealth to infiltrate and maintain persistence within targeted networks. The lack of known exploits in the wild indicates these may be targeted or limited campaigns rather than widespread outbreaks.

Indicators of compromise

Domains 2

tronracing.com
load.auraria.org

URLs 4

http://166.88.11.10/upload/check.asp
http://23.27.140.49/Onenote/index.asp
http://load.auraria.org/index.php
http://tronracing.com/upload/check.asp

IP addresses 2

166.88.11.10
23.27.140.49

Hashes 11

17ed62943568cb3ba5b858c26081a100
d28f74a6b2dd6301f2d30f46600f6bd6
9a06044008b1b2bc95664fead761d56c051b5d96
f7aaad1821314cdb0987754a74cb6bb31b3b982e
10c3b3ab2e9cb618fc938028c9295ad5bdb1d836b8f07d65c0d3036dbc18bbb4
20e0db1d2ad90bc46c7074c2cc116c2c08a8183f3ac6f357e7ebee0c7cc02596
368769df7d319371073f33c29ad0097fbe48e805630cf961b6f00ab2ccddbb4c
509fb00b9d6eaa74f54a3d1f092a161a095e5132d80cc9cc95c184d4e258525b
b5eae8de6f5445e06b99eb8b0927f9abb9031519d772969bd13a7a0fb43ec067
c60587964a93b650f3442589b05e9010a262b927d9b60065afd8091ada7799fe

Community reviews

Loading reviews…