Kimsuky compromised South Korean groupware developers through a mail-server vulnerability and suspected spearphishing, then used stolen internal information and credentials to reach downstream customer systems. The attackers deployed Gomir and HttpTroy alongside DWAgent and proxy tooling, manipulated a groupware login page to capture credentials, and installed malware on customer servers. ENKI identified two new Go-based Linux backdoors, BirdTroy and DriveTroy, which share Gomir code and persistence patterns while using HTTP/3 and Google Drive for command-and-control. Malware similarities, reused infrastructure, a shared build username, and tooling overlap support the report's attribution to the North Korea-backed Kimsuky group.