AhnLab tracks HappyDoor as a Kimsuky backdoor first collected in 2021 and still active in 2024, with recent samples hard-coding version 4.2 and dates from late 2023 to early 2024. The malware is delivered through spear-phishing attachments that unpack a JScript or dropper, decode HappyDoor with certutil, and launch it through regsvr32 with distinctive /i arguments such as syrsd* or s*. ASEC says the backdoor supports screenshots, keylogging, file monitoring and exfiltration, connected-device enumeration, microphone recording, and Android MTP file theft, with C2s hosted on p-e.kr and related domains. The report distinguishes HappyDoor from AppleSeed by its execution arguments and documents ongoing monthly patching by the actor.