Kimsuky (APT43) Supply Chain Campaign: BirdTroy and DriveTroy Linux Backdoors Hidden Inside South Korean Groupware Vendors, Google Drive Abused for C2 over HTTP/3 QUIC

ENKI WhiteHat published a full technical analysis on July 20 revealing that Kimsuky compromised at least two South Korean collaborative-work software vendors from November 2025 into early 2026 — gaining initial access via mail-server RCE and employee social engineering — then used those footholds to silently reach downstream SaaS customers. Two previously unknown Go-based Linux backdoors, BirdTroy and DriveTroy (Gomir family variants), were deployed: BirdTroy uses HTTP/3 QUIC to blind TCP-based network monitoring tools, while DriveTroy routes all C2 and exfiltration through legitimate Google Drive OAuth API calls encrypted with TLS, making network-layer detection structurally impossible without QUIC-aware inspection. The actors also tampered with vendor login pages to harvest employee credentials and stole customer server infrastructure data for downstream targeting.

This intelligence brief has been compiled from open-source reporting and corroborated across multiple threat intelligence sources. Defenders should treat the high severity rating as a guide to prioritization within their environment.

For the latest indicators of compromise, formatted SIEM queries, and unredacted actor intelligence related to this brief, DMZ Operator subscribers receive automated IOC packages via email the moment new advisories are published.