New HttpTroy Backdoor Poses as VPN Invoice in Targeted Cyberattack on South Korea

North Korea’s ‘HttpTroy’ Backdoor Exposed – Inside the Stealth Hack Shaking Cybersecurity and Stocks

Kimsuky’s “HttpTroy” – A Fake VPN Invoice with a Real Backdoor A new threat actor playbook has emerged from North Korea’s shadowy cyber-espionage operations. In early November 2025, researchers revealed that the DPRK-linked group Kimsuky (aka Velvet Chollima or Thallium) deployed a previously unknown malware dubbed “HttpTroy.” The twist? Kimsuky’s hackers delivered this backdoor under the guise of an innocuous VPN invoice email webpronews.com. T…

North Korean Kimsuky Deploys HttpTroy Backdoor in VPN Phishing Attacks

In the shadowy world of state-sponsored cyber espionage, a new threat has emerged that underscores the evolving tactics of North Korean hackers. Cybersecurity researchers have uncovered a sophisticated backdoor malware dubbed HttpTroy, which masquerades as an innocuous VPN invoice to infiltrate systems in South Korea. This campaign, attributed to the notorious Kimsuky group, highlights how attackers are leveraging everyday business lures to achi…

New HttpTroy Backdoor Poses as VPN Invoice in Targeted Cyberattack on South Korea

The North Korea-linked threat actor known as Kimsuky has distributed a previously undocumented backdoor codenamed HttpTroy as part of a likely spear-phishing attack targeting a single victim in South Korea. Gen Digital, which disclosed details of the activity, did not reveal any details on when the incident occurred, but noted that the phishing email contained a ZIP file ("250908_A_HK이노션