New Kimsuky campaign compromised South Korean software vendors

North Korean hackers compromised South Korean collaborative-work software vendors to breach their customers. The Kimsuky group, also known as APT43, used remote code execution and social engineering. Researchers at ENKI WhiteHat detected the Gomir malware and new variants on vendor and customer servers.