Adversary Intelligence — 2026-05-30

North Korean Kimsuky Group Deploys New HTTPSpy Malware Against South Korean Military and Corporate Targets

BLUFKimsuky's pivot to legitimate cloud infrastructure for command channels renders network-layer detection ineffective and demands endpoint behavioral controls across allied defense-industrial networks now facing active targeting.

Kimsuky targeted South Korean military and corporate entities in March and April 2026, deploying an HTTPSpy RAT variant through spoofed security-software pages and a counterfeit Cisco Webex meeting page via a new three-stage execution chain 12. ENKI assessed the Webex lure used meeting schedule details obtained from a previously compromised attendee's device, with the malware opening a legitimate meeting room as cover following infection 1. ENKI identified a real-time infection-verification technique called "JSONPing," in which the distribution page queries a malware-hosted local server on the victim's machine to confirm execution status before prompting re-installation 1. Kaspersky separately documented Kimsuky's adoption of VS Code Remote Tunneling and Cloudflare Quick Tunnels for covert post-exploitation access alongside two new PebbleDash variants, HelloDoor and HttpMalice, active against defense, military, and government targets in South Korea, Brazil, and Germany 2.

Analysis
Kimsuky's shift to VS Code Remote Tunneling and Cloudflare Quick Tunnels as C2 channels, documented independently by Enki and Kaspersky from separate telemetry, renders network-signature detection ineffective and requires endpoint behavioral controls to compensate. JSONPing closes the distribution-to-confirmed-compromise gap in real time, raising operational yield on every active distribution page. The Webex lure's meeting schedule may have been sourced through open-source calendaring or social engineering rather than prior device compromise, which would reduce the inference of sustained access within South Korean military networks. PebbleDash-cluster activity in Brazilian and German defense organizations and HelloDoor's Rust development confirm deliberate investment in endpoint-detection evasion at scale, beyond the Korean Peninsula.

4 sources

Kimsuky's Advanced Attack Techniques: JSONPing, Webex Spoofing, and a New HttpSpy Variant - Enki White Hat
Kimsuky Deploys HTTPSpy, Expands Arsenal with HelloDoor and VS Code Tunnels - The Hacker News
North Korean hackers Kimsuky target South Korea with new malware variants - SC Media
Disclosing new PebbleDash-based tools by Kimsuky - Kaspersky / Securelist