Kimsuky APT Deploying Linux Backdoor Gomir in South Korean Cyber Attacks

Symantec reports that the North Korea-linked APT group Kimsuky (Springtail) is using a Linux backdoor named Gomir—structurally similar to its GoBear backdoor—alongside distribution of Troll Stealer via trojanized installers and fake software updaters targeting South Korean organizations, demonstrating supply-chain-style infection vectors and shared code across malware families.