Threat intelligence / Malware

HTTPTroy

[HTTPTroy](https://attack.mitre.org/software/S9007) is a highly obfuscated backdoor that facilitates collection, command and control, defense evasion and exfiltration. [HTTPTroy](https://attack.mitre.org/software/S9007) was first reported in October 2025. [HTTPTroy](https://attack.mitre.org/software/S9007) has been observed in operations attributed to DPRK-affiliated threat actors, including [Kimsuky](https://attack.mitre.org/groups/G0094). [HTTPTroy](https://attack.mitre.org/software/S9007) has been delivered to victims through a separate loader leveraged by [Kimsuky](https://attack.mitre.org/groups/G0094).(Citation: Gen Digital Kimsuky HTTPTroy October 2025)

Malware

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[HTTPTroy](https://attack.mitre.org/software/S9007) is a highly obfuscated backdoor that facilitates collection, command and control, defense evasion and exfiltration. [HTTPTroy](https://attack.mitre.org/software/S9007) was first reported in October 2025. [HTTPTroy](https://attack.mitre.org/software/S9007) has been observed in operations attributed to DPRK-affiliated threat actors, including [Kimsuky](https://attack.mitre.org/groups/G0094). [HTTPTroy](https://attack.mitre.org/software/S9007) has been delivered to victims through a separate loader leveraged by [Kimsuky](https://attack.mitre.org/groups/G0094).(Citation: Gen Digital Kimsuky HTTPTroy October 2025)

Labels

malware

14 recorded

Relationships

uses

to Bypass User Account Control

Technique

uses

to Deobfuscate/Decode Files or Information

Technique

uses

to Dynamic API Resolution

Technique

uses

to Exfiltration Over C2 Channel

Technique

uses

to File Deletion

Technique

uses

to Ingress Tool Transfer

Technique

uses

Technique

uses

to Non-Standard Encoding

Technique

uses

to Obfuscated Files or Information

Technique

uses

to Screen Capture

Technique

uses

to Symmetric Cryptography

Technique

uses

to Web Protocols

Technique

uses

to Windows Command Shell

Technique

uses

Group

2 external

References

mitre-attack

S9007

Gen Digital Kimsuky HTTPTroy October 2025

https://www.gendigital.com/blog/insights/research/dprk-kimsuky-lazarus-analysis