Kimsuky Targets South Korean Software Vendors in Supply Chain Espionage Campaign
North Korean APT group Kimsuky has launched a new campaign compromising collaborative-work software vendors in South Korea to gain access to their downstream customers.
The North Korean advanced persistent threat (APT) group Kimsuky, also known as APT43, has been implicated in a sophisticated espionage campaign targeting vendors of collaborative-work software in South Korea. Researchers from the South Korean cybersecurity firm ENKI WhiteHat uncovered evidence that the group compromised these vendors between 2025 and early 2026, with the apparent goal of leveraging this access to infiltrate the vendors' customer base. This strategy aligns with Kimsuky's historical focus on intelligence gathering and its increasing adoption of supply-chain attack vectors.
The campaign employed multiple initial access methods. In one observed instance, Kimsuky exploited an externally facing mail server on a groupware vendor's infrastructure. By leveraging a remote code execution vulnerability, the attackers were able to install malware and establish a foothold. In another case, the threat actors utilized social engineering tactics to compromise an employee, subsequently deploying remote access tools on their workstation.
Once initial access was secured within the vendor networks, Kimsuky operators deployed a mix of known and new malware. The previously identified Gomir malware was utilized, alongside novel variants, indicating ongoing development and adaptation by the group. The attackers engaged in aggressive lateral movement within the compromised environments, actively seeking and exfiltrating customer server information. This intelligence was then used to target the vendor's downstream clients, demonstrating a clear objective of expanding their reach through compromised third parties.
Further compromising the security posture of the targeted vendors, Kimsuky also tampered with login pages. This malicious activity was designed to harvest employee credentials, a common tactic to gain further access or facilitate future attacks. ENKI WhiteHat highlighted that a significant contributing factor to these compromises was the lack of multifactor authentication (MFA) on affected systems, which allowed for easier credential stuffing and session hijacking once credentials were stolen.
Kimsuky is a well-documented threat actor known for conducting intelligence gathering operations on behalf of the North Korean regime. The U.S. government sanctioned the group in 2023 for its persistent use of spear-phishing campaigns targeting individuals in government, research, academia, and media. The group's activities have been consistently monitored, with researchers from AhnLab SEcurity Intelligence Center also detailing Kimsuky campaigns against small South Korean businesses in 2024.
The current campaign underscores a growing trend among APT groups to target the software supply chain. By compromising vendors, attackers can gain access to a wide array of downstream targets, often with less robust security controls than the initial vendor. This approach allows for more efficient and widespread compromise, making it a highly attractive strategy for espionage-focused groups like Kimsuky.
The implications of this campaign extend beyond the directly compromised vendors. Their customers, who rely on these collaborative-work solutions, are now at increased risk of secondary infections and data breaches. The discovery serves as a critical reminder for organizations to rigorously vet the security practices of their software suppliers and to implement strong internal security measures, including comprehensive MFA deployment and continuous monitoring for lateral movement.
While specific details on the affected vendors and their customers remain undisclosed by researchers, the campaign highlights the persistent and evolving threat posed by North Korean state-sponsored cyber operations. The group's ability to adapt its tactics, from exploiting technical vulnerabilities to employing social engineering and developing new malware, demonstrates a significant and ongoing threat to South Korean technology sectors and potentially their international partners.