North Korean APTs Upgrade Arsenal: Kimsuky Uses Stealthy HttpTroy, Lazarus Deploys New BLINDINGCAN RAT

Researchers at Gen Threat Labs have identified two new toolsets in active use by North Korean state-sponsored groups, underscoring continued investment in cyber-espionage. The Kimsuky operation is deploying a stealthy new backdoor dubbed “HttpTroy,” while the Lazarus Group has been observed using an upgraded variant of its BLINDINGCAN remote access tool.

According to Gen Threat Labs, the campaigns reveal a pattern of stealthy code and layered obfuscation, with both groups refining toolchains for persistence, data theft, and covert command execution across targets in South Korea and Canada. The Kimsuky operation began with a phishing lure disguised as a VPN service invoice, delivering a multi-stage chain that leads to the HttpTroy backdoor, which can perform file transfers, command execution, reverse shells, and screenshots.

In a parallel development, two infected hosts in Canada were caught mid-chain as Lazarus’ Comebacker dropper delivered the new BLINDINGCAN variant, described as adding multi-layered encryption, runtime configuration, and expanded command support. The new BLINDINGCAN variant supports 27 commands and features AES-128-CBC encryption with MD5 integrity verification, enabling exfiltration, system enumeration, webcam capture, and in-memory payload loading.