source_3852_7RaMRvT.pdf (3 MB)

Enki WhiteHat links a series of compromises at South Korean groupware vendors and their customers to Kimsuky, with attackers exploiting server vulnerabilities and spear-phishing employees to establish initial access. The intrusions deployed Gomir, HttpTroy, BirdTroy, DriveTroy and HelloDoor for remote control, credential theft, reverse proxying and lateral movement into deployment and development servers. Attackers also modified a groupware login page to exfiltrate plaintext credentials and used Google Drive and Cloudflare Tunnel infrastructure for command and control. The investigation identified at least four customers compromised through one vendor's product and five additional victim servers through infrastructure tracking.