Kimsuky targeted South Korean military and corporate entities with fake security software and Webex lures to deliver HTTPSpy and other payloads, while using techniques like JSONPing and stolen meeting schedules to improve infection success. Kaspersky also reported that Kimsuky is evolving its toolset with VS Code tunneling, DWAgent, and new malware...

The North Korean state-sponsored threat actor known as Kimsuky (aka Velvet Chollima) has been attributed to a fresh set of cyber attacks targeting South Korean military and corporate entities through March and April 2026. "Kimsuky employed a range of tailored social engineering tactics, such as spoofing security software installation pages and crafting a fake Webex meeting page that leveraged

Kimsuky used fake security tools and Webex pages in March-April 2026 to deploy HTTPSpy, enabling persistent espionage and data theft.

Curate Feeds | Make Collections | Customize Email Briefs

Groups Conversations All groups and messages Sign in Technical - Application Security Conversations About Privacy • Terms     Kimsuky's Advanced Attack Techniques: JSONPing, Webex Spoofing, and a New HttpSpy Variant 0 views Eyal Estrin unread, 5:15 AM (4 minutes ago)    to https://www.enki.co.kr/en/media-center/blog/kimsuky-s-advanced-attack-techniques-jsonping-webex-spoofing-and-a-new-httpspy-variant Eyal Estrin Author | Cloud Architect | AWS • Azure • GCP Insights Social: @eyalestrin Connect: https://linktr.ee/eyalestrin Blog: https://security-24-7.com Reply all Reply to author Forward

The North Korean state-sponsored threat actor known as Kimsuky (aka Velvet Chollima) has been attributed to a fresh set of cyber attacks targeting South Korean military and corporate entities through March and April 2026. "Kimsuky employed a range of tailored social engineering tactics, such as spoofing security software installation pages and crafting a fake Webex meeting page that leveraged

Kimsukyが2026年3月～4月、偽のセキュリティツールとWebexページを悪用してHTTPSpyを展開。持続的なスパイ活動とデータ窃取を実行。HelloDoorおよびVS Code Tunnelsの悪用により攻撃手法をさらに拡充している。

Kimsuky used fake security tools and Webex pages in March-April 2026 to deploy HTTPSpy, enabling persistent espionage and data theft.

Kimsuky used fake security tools and Webex pages in March-April 2026 to deploy HTTPSpy, enabling persistent espionage and data theft.

The North Korean state-sponsored threat actor known as Kimsuky (aka Velvet Chollima) has been attributed to a fresh set of cyber attacks targeting South

Kimsuky used fake security tools and Webex pages in March-April 2026 to deploy HTTPSpy, enabling persistent espionage and data theft.