New HttpTroy Backdoor Poses as VPN Invoice in Targeted Cyberattack on South Korea

On 3 November 2025, The Hacker News reported that the North Korea-linked threat actor Kimsuky has distributed a backdoor codenamed HttpTroy as part of a spear-phishing campaign targeting a single victim in South Korea. According to Gen Digital, the phishing email carried a ZIP file masquerading as a VPN invoice, with the Archive containing a SCR file that launches a Golang-based backdoor and an embedded decoy PDF to avoid suspicion.

The delivery chain comprises a small dropper, a loader called MemLoad, and the final backdoor, with MemLoad setting up persistence via a scheduled task named “AhnlabUpdate” and attempting to impersonate the South Korean cybersecurity firm AhnLab before decrypting and executing the DLL backdoor.

The implant provides full control over the compromised system, enabling file transfer, screenshot capture, elevated command execution, in-memory loading of executables, reverse shell, process termination and trace removal, communicating with its C2 server via HTTP POST requests. The campaign also illustrates a multi-layer obfuscation approach, with dynamic API reconstruction and XOR-based string obfuscation to complicate analysis, as the actors seek to maintain access and extend their control.