Kimsuky (APT43) Supply-Chain Campaign Against South Korean Groupware Vendors Surfaces Two New Go Backdoors — BirdTroy Uses HTTP/3 QUIC to Blind Enterprise Firewalls

ENKI WhiteHat published a full technical analysis on July 20 attributing a 2025–early 2026 supply-chain campaign to Kimsuky (APT43), in which attackers compromised at least two South Korean collaborative-work software vendors via mail-server RCE exploitation and employee social engineering, then pivoted to downstream SaaS customers. Two previously undocumented Go-based backdoors — BirdTroy and DriveTroy — were identified alongside Gomir variants; BirdTroy's HTTP/3 QUIC transport option renders it invisible to TCP-based network inspection stacks, while DriveTroy abuses Google Drive for C2 and exfiltration. Attackers also tampered with vendor login pages to harvest employee credentials at scale, with the absence of MFA enabling immediate account takeover across customer environments.

Attackers also tampered with vendor login pages to harvest employee credentials at scale, with the absence of MFA enabling immediate account takeover across customer environments.

This intelligence brief has been compiled from open-source reporting and corroborated across multiple threat intelligence sources. Defenders should treat the high severity rating as a guide to prioritization within their environment.

For the latest indicators of compromise, formatted SIEM queries, and unredacted actor intelligence related to this brief, DMZ Operator subscribers receive automated IOC packages via email the moment new advisories are published.