Back www.intel471.com

Network defenders cannot distinguish DriveTroy's command-polling from any other employee accessing Google Drive

www.intel471.com • July 24, 2026

Malware distribution campaigns that trick people into copying and pasting malicious commands, known as ClickFix, have been wildly successful. Here's an examination of ClickFix and how to defend against it.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Kimsuky Exploits South Korean Groupware Vendors with New Gomir Variants The Kimsuky group, linked to North Korea, targeted South Korean groupware vendors from late 2025 to early 2026, deploying new malware variants BirdTroy and DriveTroy. These Linux backdoors utilized Google Drive for command-and-control operations, enabling lateral movement to customer systems. Initial access was gained through remote code execution vulnerabilities and spear-phishing tactics. The campaign compromised at least two vendors, with attackers modifying login pages to harvest credentials. The ENKI WhiteHat report provides detailed analysis and Indicators of Compromise (IoCs) for detection. This operation reflects Kimsuky's ongoing focus on South Korean corporate infrastructure, leveraging previously undocumented malware. The attack's impact extends to downstream customers, potentially affecting numerous organizations reliant on the compromised groupware platforms. 4 sources 77

Network defenders cannot distinguish DriveTroy's command-polling from any other employee accessing Google Drive

The full story

Extracted Entities

Attack Types (1)

Malware (1)