Analysis of Kimsuky's Attack on a South Korean Groupware Vendor Using a New Gomir Family Variant

Reported 20 Jul 2026 by otx · Severity: medium

Between 2025 and early 2026, the North Korean-linked Kimsuky group infiltrated South Korean groupware vendors through vulnerability exploitation and spear-phishing. They deployed two new malware variants, BirdTroy and DriveTroy, based on the Gomir/HttpTroy family. BirdTroy uses c