North Korea Hid New Google Drive Backdoors Inside South Korean Groupware Firms

North Korea's Kimsuky espionage group spent the better part of a year hiding inside South Korean enterprise software companies — and when defenders weren't looking, it tunneled into those companies' customers using two previously unknown Linux backdoors that route their command signals through Google Drive and a protocol deliberately chosen to blind conventional network security tools. South Korean cybersecurity firm ENKI WhiteHat published a full technical analysis on July 20, 2026 , naming the two new malware families BirdTroy and DriveTroy and attributing the campaign to the state- group with high confidence.

The campaign began in November 2025 and continued into early 2026, targeting at least two South Korean collaborative-work software vendors . For organizations that rely on South Korean groupware platforms — a category that includes project management, email, document sharing, and internal communications tools — the breach at the vendor level translated silently into access at the customer level, without any action required on the customer's part.

The hackers did not use a single entry point. In the first case, confirmed in November 2025, Kimsuky exploited a remote code execution vulnerability in an externally accessible mail server to install the Gomir backdoor. In the second, confirmed in December 2025, they social-engineered an employee at a different groupware developer and deployed remote access tools on that employee's PC .

Once inside both networks, the operators moved fast. At the first vendor, they located the company's SaaS infrastructure configuration — specifically its Voice-of-Customer (VOC) server, which held directory listings and access credentials for customer deployments — and used that information to install Gomir on at least one downstream customer's servers . At the second vendor, ENKI researchers monitoring the attackers' Google Drive account observed a second customer's server appear in the attacker's logs the day after DriveTroy was first installed. A few days later, the attackers used the same foothold to read a third organization's groupware email without authorization.

To harvest credentials they could not access by brute force — because employee passwords are stored as hashed values on servers — Kimsuky tampered with the groupware login page itself, modifying it to intercept and transmit plaintext usernames and passwords to an attacker-controlled server over HTTPS each time an employee logged in. The compromised vendors lacked multi-factor authentication on their groupware portals, which meant the harvested credentials provided immediate, unchallenged access.

The ENKI report's most consequential technical finding is the identification of two previously undocumented Go-based Linux backdoors: BirdTroy and DriveTroy. Both are variants of Gomir, which Symantec first documented in May 2024 as a Linux version of Kimsuky's Windows GoBear remote access trojan. The three malware families identical persistence logic (systemd service or crontab installation depending on whether the malware runs as root), the same bot-ID generation approach, and closely mirrored command structures — evidence the same development team built all three .

What separates BirdTroy from its predecessor is a transport option that Gomir does not offer. Operators can launch BirdTroy with the -method http3 flag, which switches its command-and-control communications from standard HTTPS over TCP to HTTP/3 over QUIC — a protocol running on UDP rather than TCP.

What separates DriveTroy is that it has no custom C2 server at all. Instead, it polls a file named after the victim's unique identifier in an attacker-controlled Google Drive account — checking every second for a new command, and uploading results to a different file in the same Drive — using hardcoded OAuth credentials embedded in the binary itself . The attacker's Google account ( [email protected] ) is now publicly documented, which means Google's security team can revoke the OAuth credentials and disable deployed DriveTroy instances' C2 channels.

ENKI researchers also noted signs of evolving development practices in the newer malware, including probable AI-assisted code and continued reliance on free South Korean hosting domains for C2 infrastructure.

This is the part of ENKI's report that matters most to defenders who run network security tools — and it is the part most likely to go unnoticed in a summary reading.

Most enterprise network security appliances — firewalls, intrusion detection and prevention systems, data-loss prevention tools, cloud secure web gateways — are built to inspect TCP traffic. HTTP/3's underlying transport, QUIC, runs on UDP port 443 instead . Because QUIC bundles TLS encryption directly into the transport layer and was specifically designed to resist middlebox inspection , traditional TCP-based network monitoring tools go effectively dark when BirdTroy switches to its HTTP/3 mode. The traffic is indistinguishable from ordinary QUIC web traffic on any network that permits it, and it carries no malformed headers or unusual patterns that signature-based detection would catch.

The mitigation is straightforward but has a cost: block UDP port 443 at the perimeter. Because modern browsers including Chrome and Edge negotiate QUIC by default for connections to major platforms, blocking UDP/443 may cause legitimate browser connections to fall back to HTTP/2 — something most organizations can tolerate. For networks that cannot block UDP/443, organizations need QUIC-aware network inspection capabilities rather than traditional TCP proxies. Any environment relying on standard network monitoring to detect Kimsuky's new backdoor variants may be systematically blind to BirdTroy C2 traffic when operators choose the HTTP/3 transport option.

DriveTroy's architecture makes detection even harder at the network layer. Its C2 traffic is authenticated Google Drive API traffic — using legitimate OAuth tokens, connecting to Google's own infrastructure, encrypted with TLS. Network defenders cannot distinguish DriveTroy's command-polling from any other employee accessing Google Drive for work.

This approach is not novel. APT41 used a red-team tool called GC2-Sheet that abused the Google Sheets API for C2 in 2023 . In February 2026, Google's own Threat Intelligence Group disclosed a campaign by a separate espionage actor using Google Sheets for C2 against 53 victims in 42 countries. DriveTroy represents Kimsuky's own entry into this documented and growing operational-security technique — and its Go-based implementation on Linux specifically targets the server infrastructure that groupware companies operate.

The one structural weakness: DriveTroy's OAuth credentials are hardcoded in the binary and are now publicly disclosed. Anyone who retrieves the binary can extract the client ID, client secret, and refresh token, and Google can revoke them. ENKI's publication effectively arms defenders with a kill switch for deployed DriveTroy instances — if those credentials are reported to Google's security team, infected servers lose their C2 channel.

ENKI's attribution to Kimsuky rests on multiple overlapping indicators confirmed independently :

All three backdoors — Gomir, BirdTroy, and DriveTroy — the same HTTPS certificate: an XAMPP default certificate issued with the subject "Apache Friends / localhost" that has appeared across multiple prior Kimsuky campaigns. C2 server IP addresses in this campaign belong to ASNs 19318 and 26666, both previously tied to Kimsuky infrastructure. The Windows build path embedded in DriveTroy ( C:/Users/jira/go/src/jira/payload/ ) contains the username "jira," which also appeared in prior ENKI analysis of Kimsuky's HttpSpy malware from May 2026. DWAgent — a legitimate remote desktop tool previously documented in Kimsuky's Kaspersky-analyzed PebbleDash cluster — was deployed at the second vendor to maintain interactive access to compromised Windows workstations. A proxy tool recovered from the second vendor uses the authentication key dkanehahffk , which is the Korean-language phrase "아무도몰라" ("nobody knows") typed in a Korean keyboard with the language mode accidentally set to English — a small artifact that confirms Korean-language development.

Kimsuky, also tracked as APT43, Emerald Sleet, and Velvet Chollima, has operated since at least 2012 under North Korea's Reconnaissance General Bureau, the DPRK's primary foreign intelligence service. Unlike Lazarus Group — which North Korea uses to steal cryptocurrency to fund weapons programs — Kimsuky's mission is intelligence collection: gathering geopolitical, military, and foreign policy information to support Pyongyang's decision-making. The US Treasury sanctioned the group in November 2023 for cyber espionage campaigns that directly support North Korea's strategic and nuclear ambitions, a designation the US coordinated with Australia, Japan, and South Korea.

South Korea remains Kimsuky's primary target — accounting for approximately 60% of documented operations — with secondary focus on the United States, Japan, and Europe, according to analysis of the group's decade-long activity . Enterprise groupware platforms are a logical target for an intelligence-collection unit: they are the repositories of internal corporate communications, shared documents, and directory structures for thousands of employees. Breaching the vendor rather than individual customer organizations gives Kimsuky a single point of access to potentially hundreds of downstream networks, all through a trusted software relationship those customers never thought to scrutinize.

ENKI's report notes that this represents a deliberate evolution in Kimsuky's operational approach — placing greater emphasis on indirect attacks through partners and suppliers rather than direct spear-phishing against individual targets.

ENKI published YARA detection rules for all three malware families (BirdTroy, DriveTroy, and Gomir) alongside the full report, along with MD5 file hashes and a set of C2 indicators including IP addresses and .o-r.kr domain patterns. Organizations using South Korean collaborative-work software should take the following steps:

Audit authentication logs for anomalous login activity, particularly against groupware login portals. The login-page tampering technique means stolen credentials may have been used to authenticate legitimately — making detection dependent on behavioral anomalies (unusual login times, unusual source IPs) rather than authentication failures.

Hunt for Gomir-family artifacts on Linux servers using the published YARA rules and MD5 hashes. Gomir establishes persistence as a systemd service named rsyslogd or as a crontab entry; BirdTroy uses the same persistence names; DriveTroy randomizes its service name among syslogd , logd , cachelogd , cachemond , and monlogd .

Block UDP port 443 at the perimeter if possible, or implement QUIC-aware network inspection. This is the primary mitigation against BirdTroy's HTTP/3 transport mode and prevents a systematic inspection blind spot.

Monitor outbound traffic to Google Drive APIs for unusual patterns. DriveTroy polls Google Drive every second — a request frequency that may appear anomalous in network flow logs even though the destination domain is legitimate.

Review DWAgent deployments for instances not sanctioned by IT. DWAgent is a legitimate remote management tool, but undocumented instances may indicate a Kimsuky foothold.

Apply available patches promptly to externally accessible mail servers. A remote code execution vulnerability in a public-facing mail server was the initial entry point in at least one of the compromised vendors.

Implement multi-factor authentication on groupware portals. The credential-harvesting attack succeeded in part because the login portals lacked MFA. With MFA in place, harvested credentials cannot be used directly for unauthorized login.

Kimsuky (also called APT43) is a North Korean state- espionage group that has operated since at least 2012 under North Korea's Reconnaissance General Bureau. Its mission is intelligence collection — gathering geopolitical, military, and foreign policy information — rather than financial theft. South Korean groupware vendors are attractive targets because their platforms host internal communications, documents, and directory information for thousands of corporate and government customers. Breaching a vendor once gives Kimsuky access to potentially hundreds of downstream organizations simultaneously, through a trusted software relationship those organizations never expected to be weaponized.

DriveTroy embeds hardcoded Google OAuth credentials in its binary (now publicly disclosed by ENKI). After installation, it polls a file named after the victim's unique identifier in an attacker-controlled Google Drive account every second, downloads any new command, executes it, and uploads results to a separate file in the same Drive. Network defenders cannot distinguish this activity from an employee using Google Drive normally — because the traffic uses legitimate Google APIs, encrypts with TLS, and connects to Google's own infrastructure. The published credentials can be reported to Google's security team, which could revoke them and cut off deployed DriveTroy instances from their C2 channel.

Most enterprise network security tools — firewalls, intrusion detection systems, cloud secure web gateways — are built to inspect TCP-based traffic. HTTP/3 runs on QUIC, which uses UDP rather than TCP, and bundles TLS encryption at the transport layer. Defenders running traditional TCP-based network monitoring will not be able to inspect BirdTroy's C2 traffic when operators select the HTTP/3 mode. The primary mitigation is to block UDP port 443 at the network perimeter, which forces BirdTroy to fall back to standard HTTPS, or to deploy network inspection tools that specifically support QUIC traffic analysis.

In a supply-chain attack, the attacker compromises a software vendor or service provider rather than attacking target organizations directly. Once inside the vendor, the attacker can access customer environments through the trust relationship between vendor and customer — using stored configuration data, access credentials, or the vendor's own administrative tools. The key implication for customers is that they may be compromised without any action on their part, and without any indicators visible to their own security teams. Defending against this requires vendor security assessments that go beyond self-reported attestations, and monitoring for behavioral anomalies inside customer systems that cannot be explained by the customer's own activity.