HTTPTroy

MITRE ATT&CK: S9007 View on attack.mitre.org

Aliases: HTTPTroy

First seen
2025-10-01 00:00:00
Malware type
backdoor, loader
Family
Malware family
Operating systems
windows
Profile updated
2026-07-07 14:54:24

Targeted industries: government-and-public-sector technology-and-telecommunications

Targeted regions: country_code:kr country_code:jp country_code:us

Context

HTTPTroy is a highly obfuscated backdoor that facilitates collection, command and control, defense evasion and exfiltration. HTTPTroy was first reported in October 2025. HTTPTroy has been observed in operations attributed to DPRK-affiliated threat actors, including Kimsuky. HTTPTroy has been delivered to victims through a separate loader leveraged by Kimsuky.

Detection coverage

  • 320 Sigma rules

Malware & tools used

  • Ingress Tool Transfer (attack-pattern)
  • Windows Command Shell (attack-pattern)
  • Symmetric Cryptography (attack-pattern)
  • Obfuscated Files or Information (attack-pattern)
  • Non-Standard Encoding (attack-pattern)
  • Dynamic API Resolution (attack-pattern)
  • Exfiltration Over C2 Channel (attack-pattern)
  • Screen Capture (attack-pattern)
  • Web Protocols (attack-pattern)
  • Deobfuscate/Decode Files or Information (attack-pattern)
  • Native API (attack-pattern)
  • File Deletion (attack-pattern)
  • Bypass User Account Control (attack-pattern)

Used by threat actors

Reports & references

  • gendigital.com — Dprk Kimsuky Lazarus Analysis (report)
  • MITRE ATT&CK — S9007 (report)

External references