Kimsuky Exploits South Korean Groupware Vendors with New Gomir Variants

Kimsuky targeted South Korean groupware vendors between late 2025 and early 2026, deploying new Linux backdoors named BirdTroy and DriveTroy that used Google Drive for command-and-control. Attackers gained initial access via remote code execution flaws and spear-phishing, modified login pages to harvest credentials, and moved laterally to downstream customers; the ENKI WhiteHat report includes detailed IoCs for detection and mitigation.