New Gomir Variant Used in Kimsuky Attack on South Korean Groupware Vendor

Summary

The North Korea-linked group Kimsuky targeted South Korean groupware vendors through a combination of vulnerability exploitation and spear-phishing. The campaign deployed new Gomir malware variants, including BirdTroy and DriveTroy, which use custom communication protocols and Google Drive for command-and-control operations. The attackers were able to pivot from the vendors to downstream customers by stealing infrastructure credentials and accessing customer data.

Investigation

ENKI WhiteHat analyzed the campaign across 2025 and early 2026 and identified several malware strains developed in Go. The investigation showed how Kimsuky combined remote code execution on mail servers with social engineering to secure initial access. Analysts also discovered credential theft through tampered groupware login pages and abuse of legitimate tools such as DWAgent.

Mitigation

Organizations should conduct regular penetration testing to identify exposed attack surfaces and possible lateral movement routes. Implementing secondary authentication mechanisms such as TOTP is essential to reduce the risk of unauthorized access through stolen credentials. Software vendors should also encrypt customer authentication keys and enforce strict network segmentation between management systems and production environments.

Response

If this activity is detected, organizations should immediately rotate all compromised credentials and infrastructure keys. Audit logs should be reviewed to determine the scope of lateral movement and data exfiltration. It is also recommended to deploy comprehensive monitoring for unauthorized systemd service changes and unusual traffic to cloud storage services.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre-flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.

• Attack Narrative & Commands: An adversary has gained initial access to a Linux server and is attempting to deploy the Gomir malware. To ensure persistence and evade standard signature-based detection, they use a UPX-packed binary. The attacker executes the binary with the install argument, which triggers the malware’s internal routine to check for elevated privileges (via getegid) and establish persistence. We will simulate this by creating a dummy file named UPX 3.96_malware and executing it with the install command.

• Regression Test Script:

  #!/bin/bash
  # Simulate the Gomir Installation Routine
  
  # 1. Create a dummy 'packed' binary with the specific filename expected by the rule
  echo "#!/bin/bash" > "UPX 3.96_malware"
  echo "echo 'Simulating getegid check...'" >> "UPX 3.96_malware"
  echo "echo 'Simulating installation...'" >> "UPX 3.96_malware"
  chmod +x "UPX 3.96_malware"
  
  # 2. Execute the binary with the 'install' argument to trigger the rule logic
  # This should match: (selection_install OR selection_getegid) AND selection_upx
  echo "[+] Executing simulated malware..."
  ./"UPX 3.96_malware" install
  
  # 3. Demonstrate Evasion (Renaming the file)
  # This should NOT trigger the rule, proving the weakness
  echo "[+] Demonstrating Evasion (renaming file)..."
  mv "UPX 3.96_malware" "system_update_service"
  ./"system_update_service" install

• Cleanup Commands:

  # Remove simulation artifacts
  rm -f "UPX 3.96_malware" "system_update_service"