Kimsuky and Lazarus Hackers Deploy New Backdoor Tools for Remote Access Attacks

North Korean state-sponsored threat actors have escalated their cyber operations with the deployment of new backdoor tools for remote access attacks, according to GBHackers News. The report identifies two distinct toolsets from DPRK-aligned groups: Kimsuky’s newly identified HttpTroy backdoor and an upgraded version of Lazarus’s BLINDINGCAN remote access tool, used in campaigns that target victims across multiple countries.

In the Kimsuky operation, a ZIP archive masquerading as a VPN service invoice delivered a three-stage infection chain culminating in the HttpTroy backdoor, which provides file upload/download, screenshot capture and exfiltration, elevated command execution, in-memory loading, reverse shell, and post-compromise process termination, with all C2 traffic sent over HTTP POST and obfuscated by XOR and Base64.

The Lazarus campaign involved two Canadian victims, with an updated Comebacker malware facilitating deployment of the enhanced BLINDINGCAN variant, underscoring continued refinement of their malware frameworks. Across both campaigns, researchers note heavy obfuscation and persistence mechanisms designed to evade detection, while emphasising the need for layered defence, cautious handling of suspicious email attachments, updated security software, and behavioural detection capabilities.