Kimsuky Deploys HttpTroy Backdoor in Sophisticated VPN-Phishing Attack Against South Korea

In late 2025, the North Korean advanced persistent threat (APT) group Kimsuky launched a targeted cyberattack against an organization in South Korea using a previously undocumented backdoor dubbed 'HttpTroy.' Leveraging a spear-phishing email containing a malicious ZIP file disguised as a VPN invoice, the attackers tricked the recipient into extracting and running a disguised executable. Once executed, HttpTroy enabled encrypted communication with attacker-controlled infrastructure, allowing remote data exfiltration and persistent access. This covert operation underscored the group's ongoing focus on espionage, intelligence collection, and the use of custom malware to evade detection.

This incident is significant due to the rise of spear-phishing attacks deploying novel backdoors and the persistence of state-sponsored threats targeting geopolitical rivals. It highlights the necessity for vigilant endpoint monitoring, advanced traffic analysis, and robust segmentation to limit attacker lateral movement and safeguard sensitive communications.

State-backed threat actors increasingly use custom malware and well-crafted phishing lures to bypass conventional defenses, placing organizations at immediate risk of espionage and data theft. The discovery of HttpTroy reveals evolving adversary toolkits and points to heightened targeting of the Asia-Pacific region, demanding renewed urgency in threat detection, response, and compliance practices.