North Korean hackers target South Korean software vendors

North Korean hackers successfully targeted South Korean collaborative-work software vendors before breaching the suppliers’ customers, threat researchers at ENKI WhiteHat have found. The campaign by the Kimsuky group, also known as APT43, was carried out in 2025 and early 2026, with further coverage provided by The Record.

The Kimsuky group compromised a groupware vendor through an externally accessible mail server by exploiting a remote code execution vulnerability. Another vendor was compromised through social engineering of an employee, leading to the deployment of remote access tools. After gaining initial access, the hackers deployed known malware called Gomir and new variants. They moved laterally to steal customer server information from a vendor to target its customers.

Researchers detected Gomir installed on a server belonging to one of the compromised vendor’s SaaS customers. The hackers also tampered with login pages, harvesting employee credentials, with the lack of multifactor authentication contributing to the compromises. Kimsuky is known for intelligence gathering campaigns on behalf of Pyongyang and was sanctioned by the U.S. government in 2023 for using spear-phishing tactics.

Source: The Record