Kimsuky (APT43) Breached South Korean Groupware Vendors to Pivot to SaaS Customers via Gomir Implant — Supply Chain Attack Confirmed

ENKI WhiteHat researchers revealed a Kimsuky supply-chain operation active through early 2026, in which the DPRK group compromised South Korean collaborative-work software vendors via RCE exploitation and employee social engineering, then deployed Gomir malware plus new variants to pivot laterally into vendors' SaaS customer environments. Separately, South Korea's Ministry of Foreign Affairs disclosed July 21 that its National Diplomatic Academy e-learning platform was silently breached for ten months (April 2025–February 2026) via a zero-day, exposing ~10,000 records including overseas attachés and intelligence personnel — with North Korean state-backed groups among prime suspects.

This intelligence brief has been compiled from open-source reporting and corroborated across multiple threat intelligence sources. Defenders should treat the high severity rating as a guide to prioritization within their environment.

For the latest indicators of compromise, formatted SIEM queries, and unredacted actor intelligence related to this brief, DMZ Operator subscribers receive automated IOC packages via email the moment new advisories are published.