North Korean Kimsuky Hackers Target South Korean Military
On 29 May, cybersecurity researchers reported that North Korea–linked Kimsuky operators are attacking South Korean military and corporate networks using the HTTPSpy remote access tool. The campaign leverages fake security software pages, spoofed Webex meetings, and new backdoors for stealthier intrusions.
Key Takeaways
- As of 29 May 2026, the Kimsuky group is actively targeting South Korean military and corporate entities with the HTTPSpy remote access trojan.
- Attackers use social engineering via fake security software sites and spoofed Webex meeting invitations to distribute malware.
- Kimsuky has expanded its arsenal with the HelloDoor backdoor and the use of Visual Studio Code tunneling to enhance stealth and persistence.
- The campaign underscores persistent North Korean cyber-espionage efforts against South Korean defense and industrial targets.
On 29 May 2026, new findings from cybersecurity analysis indicated that the North Korean–aligned threat group known as Kimsuky is conducting an active campaign against South Korean military and corporate targets. The group is deploying an updated remote access trojan (RAT) called HTTPSpy, utilizing sophisticated social-engineering lures to gain initial access to victim systems.
According to technical reporting made public around 05:59 UTC, Kimsuky operators are masquerading as legitimate security-software providers and collaboration-platform hosts. They create fake security application download pages and spoofed Webex meeting links to trick targets into installing malicious payloads. Once executed, HTTPSpy establishes command-and-control channels over HTTP, allowing attackers to exfiltrate data, capture keystrokes, and potentially move laterally within compromised networks.
In addition to HTTPSpy, Kimsuky is reportedly expanding its toolkit with a backdoor framework dubbed HelloDoor, as well as leveraging Visual Studio Code’s remote-tunneling features for covert communications. These techniques help the group blend malicious traffic with legitimate development and collaboration workflows, complicating detection by traditional perimeter defenses.
Kimsuky has a long history of espionage operations focused on South Korean government agencies, defense contractors, think tanks, and media organizations, with secondary targeting in the United States, Europe, and elsewhere. The group typically pursues intelligence on defense planning, sanctions policy, nuclear and missile programs, and political dynamics. Targeting South Korean military and corporate networks suggests continued emphasis on collecting sensitive operational and technological information.
The new campaign reflects broader trends in North Korean cyber operations: increased use of living‑off‑the‑land techniques, improved malware modularity, and reliance on social engineering against carefully profiled individuals. By exploiting trusted brands such as security vendors and major conferencing platforms, Kimsuky aims to bypass user skepticism and endpoint controls.
Outlook & Way Forward
In the short term, South Korean defense institutions and companies will need to update indicators of compromise, harden access controls, and accelerate user‑awareness training—particularly around software downloads and unsolicited meeting invitations. Expect South Korean and allied cyber agencies to issue detailed advisories, share signatures for HTTPSpy and HelloDoor, and potentially conduct counter‑operations to disrupt Kimsuky infrastructure.
Over the medium term, this campaign is likely to persist and evolve rather than cease, with Kimsuky rotating infrastructure and modifying malware to evade updated detections. Organizations in the defense and high‑tech sectors should prioritize multi‑factor authentication, application allow‑listing, and behavioral anomaly detection, while monitoring for unusual VS Code tunneling activity and suspicious Webex event patterns.
Strategically, the operation reinforces the role of North Korean cyber capabilities as a key asymmetric tool for intelligence collection and, in other contexts, revenue generation. Analysts should watch for: signs that stolen data is being leveraged in diplomatic or military decision‑making; overlaps between Kimsuky infrastructure and financially motivated North Korean groups; and any coordinated responses by Seoul, Washington, and partners to impose costs on Pyongyang for continued cyber‑espionage against critical defense targets.
Sources
- OSINT