Adversary Intelligence — 2026-07-24

North Korean Kimsuky Group Compromised South Korean Software Vendors With Novel Gomir Backdoor Variants

BLUFKimsuky's pivot to groupware supply-chain compromise very likely persists through the remainder of 2026, multiplying downstream victim access while its QUIC and cloud-API channels erode conventional network monitoring.

North Korea's Kimsuky group, tracked as APT43, compromised at least two South Korean groupware vendors between November 2025 and early 2026, exploiting a remote code execution flaw in one vendor's externally accessible mail server and social-engineering an employee at the other 12. The group deployed the known Gomir backdoor plus two new Go-based Linux variants, BirdTroy and DriveTroy, with BirdTroy supporting HTTP/3-over-QUIC command traffic and DriveTroy using hardcoded Google OAuth credentials to poll an attacker-controlled Google Drive account for commands 12. ENKI reported the actors stole customer infrastructure data, including one vendor's SaaS configuration server, to install Gomir on downstream customer systems, and tampered with a groupware login page to harvest employee credentials at portals lacking multi-factor authentication 13. ENKI attributed the campaign to Kimsuky based on shared malware certificates, overlapping C2 infrastructure and ASNs, a recurring developer username, and a Korean-keyboard artifact in a recovered proxy tool's authentication key 2. The Record and SC Media corroborated ENKI's findings without independent reporting 34.

Analysis
Kimsuky's pivot to compromising groupware vendors rather than direct spear-phishing very likely persists through the remainder of 2026, exploiting the access-multiplier effect of a single breach reaching hundreds of downstream customers. BirdTroy's HTTP/3-over-QUIC transport and DriveTroy's Google Drive C2 channel show deliberate investment in evading TCP-based monitoring, pushing South Korean defenders toward QUIC-aware inspection and outbound API monitoring. Confidence is moderate: the analysis rests on a single technical vendor, ENKI WhiteHat, with other outlets republishing rather than independently verifying, though certificate, ASN, and developer-artifact overlaps offer converging rather than singular attribution signals. The overlapping infrastructure could instead reflect shared North Korean tooling distributed across multiple operator teams rather than one Kimsuky-run campaign. If the supply-chain shift holds, South Korean regulators and groupware customers face pressure toward mandatory MFA and vendor-side audits rather than incident-specific fixes at the two named vendors alone.

4 sources

Analysis of Kimsuky's Attack on a South Korean Groupware Vendor Using a New Gomir Family Variant - ENKI WhiteHat
North Korea Hid New Google Drive Backdoors Inside South Korean Groupware Firms - Tech Times
New Kimsuky campaign compromised South Korean software vendors - The Record
North Korean hackers target South Korean software vendors - SC Media