Appearance of Kimsuky group's new backdoor (HappyDoor)

Tags

External References

• https://asec.ahnlab.com/
• https://otx.alienvault.com/

Description

Asec Ahnlab analyzes a new backdoor malware called HappyDoor used by the North Korean hacking group Kimsuky in recent email attacks. The malware has evolved over time and contains capabilities for information stealing and remote access. It communicates with command and control servers using encrypted HTTP packets. The report provides technical details on the malware's registry configuration, packet structure, and main capabilities like screenshot capture, keylogging, and command execution.

Date