Kimusk’s HappyDoor: regsvr32 Exploit Evades Detection

HappyDoor is an actively developed backdoor and information stealer attributed to the Kimsuky group that is distributed via spear-phishing and JScript droppers; it persists using registry-stored configuration, communicates with a custom HTTP-based C2 protocol, and can capture screenshots, keystrokes, audio, and files while supporting remote commands and encrypted exfiltration. Researchers observed continuous updates and evolving execution arguments and obfuscation techniques between 2021 and early 2024.