Kimsuky Debuts HTTPTroy Backdoor Against South Korea Users

Kimsuky has released an updated toolset, HttpTroy, described by threat researchers as a backdoor designed to give its controllers full access to an infected system, including moving files, taking screenshots and executing commands, with the aim of making attack programs harder to detect and analyse. In its current campaign against South Korean users, the backdoor is deployed as the final step of an infection chain that begins with a small dropper and a loader known as MemLoad.

The delivery involved a zip archive containing a Microsoft Windows screensaver (.scr) file that executes when opened, displaying a PDF invoice written in Korean and loading the attack chain until HttpTroy is active.

According to Gen, HttpTroy “supports a wide range of remote actions and increases stealth by encrypting its communications, obfuscating payloads, and executing code in memory.” Researchers note that Kimsuky, along with Lazarus, uses obfuscation and anti-analysis techniques and frequently rotates and rebuilds payloads to evade detection.

The analysis also highlights the use of legitimate services and Windows processes to dodge security tools and the modular, plug-in style architecture that enables rapid extension of the capabilities.