Kimsuky compromised South Korean groupware vendors from 2025 through early 2026 through mail-server vulnerability exploitation and likely spear-phishing, then used stolen vendor information to breach downstream customers. ENKI identified BirdTroy and DriveTroy as new Go-based variants related to Gomir and HttpTroy, with BirdTroy supporting HTTP/3 and DriveTroy abusing Google Drive for command-and-control and exfiltration. The actor also deployed DWAgent and a proxy tool, stole customer infrastructure data, and modified a groupware login page to capture employee credentials. Shared malware characteristics, infrastructure, certificates, tooling, and development artifacts supported attribution to the North Korea-linked Kimsuky group.