Find notable cyber news and cases, enriched with sources, timelines, and signals.
Home Watchlists Beta Browse News Feed Stats About Contact

Kimsuky HttpTroy backdoor activity against South Korean users

Malware Activity
First reported
Last updated
Happening score
H score 23
2 unique sources, 2 articles

Summary

Hide ▲

Kimsuky deployed HttpTroy against South Korean users as the final stage of a multi-step chain that used a ZIP archive, a .scr file, and MemLoad. The backdoor can move files, take screenshots, and execute commands while encrypting communications, obfuscating payloads, and running code in memory. Separate reporting in March and April 2026 tied the group to additional campaigns against South Korean military and corporate entities that used fake security-software and Webex lures to deliver HTTPSpy and related loaders. Together, the reporting shows Kimsuky continuing to rely on staged delivery, social engineering, and remote-access tooling.

Related Happenings

Veil#Drop PureLog Stealer in-memory delivery operation

Malware Activity
H score30 First: 01.07.2026 17:30 Last: 01.07.2026 17:30 Sources 1

About this happening: Veil#Drop is delivering PureLog Stealer through a fileless chain that keeps payloads entirely in memory, reducing disk artifacts and raising the chance of evading...

Open Happening

Gentlemen ransomware EDR-killer tooling

Malware Activity
H score35 First: 19.06.2026 01:31 Last: 19.06.2026 01:31 Sources 1

About this happening: Gentlemen ransomware-as-a-service (RaaS) is actively maintaining a suite of EDR killers led by GentleKiller to disable endpoint defenses before encryption. ESET says t...

Open Happening

SprySOCKS Windows backdoor activity against government organizations

Malware Activity
H score23 First: 16.06.2026 12:00 Last: 16.06.2026 12:00 Sources 1

About this happening: SprySOCKS now has documented Windows variants, WIN_DRV and WIN_PLUS, expanding a toolset first known as a Linux-only backdoor. The activity is tied to govern...

Open Happening

ESET analysis of SprySOCKS Windows variants adds IOC-backed detection guidance

Technical Analysis
H score34 First: 16.06.2026 12:00 Last: 16.06.2026 12:00 Sources 1

About this happening: ESET identified previously undocumented Windows variants of SprySOCKS, a backdoor attributed to FishMonger and linked to I-Soon. The WIN_DRV and WIN_PLUS...

Open Happening

SPECTRALVIPER DLL sideloading backdoor activity

Malware Activity
H score31 First: 11.06.2026 12:45 Last: 11.06.2026 12:45 Sources 1

About this happening: The SPECTRALVIPER backdoor was executed on affected Windows hosts through a DLL sideloading chain during October 2025 to March 2026, giving operators a way to run...

Open Happening

Timeline

  1. 05.11.2025 04:00 3 articles · 8mo ago

    Kimsuky deploys HttpTroy backdoor against South Korean users

    Initial Disclosure

    North Korean threat group Kimsuky deploys HttpTroy as the final stage of a multi-step infection chain against South Korean users, using a ZIP archive with a Microsoft Windows screensaver (.scr) file and the MemLoad loader to launch a backdoor that can move files, take screenshots, and execute commands while encrypting communications, obfuscating payloads, and running code in memory.

    Show sources
    Open in new tab