Kimsuky Attack on South Korean Groupware Vendors

Between 2025 and early 2026, the North Korea-linked threat actor Kimsuky conducted a campaign against South Korean groupware vendors. The actor gained initial access by exploiting vulnerabilities in mail servers and using spear-phishing against employees. Once inside, they deployed new variants of the Go-based Gomir malware family, specifically BirdTroy and DriveTroy, to establish persistent access and facilitate lateral movement.

Technical analysis revealed that Kimsuky leveraged these compromises to pivot into the infrastructure of downstream SaaS and on-premises customers. They further exfiltrated plaintext credentials by tampering with internal groupware login pages, bypassing hashed password storage. The use of HTTP/3 (QUIC) and Google Drive for command-and-control (C2) demonstrates a continued shift toward evasion-focused infrastructure.

This campaign highlights the severe risk of supply-chain attacks targeting software vendors. By compromising vendor infrastructure and support systems (VOC servers), the actor successfully gained unauthorized access to customer environments and sensitive communications, impacting multiple sectors across South Korea.