Kimsuky Deploys HTTPSpy Expands Arsenal with HelloDoor and VS Code Tunnels

The North Korean statesponsored threat actor known as Kimsuky aka Velvet Chollima has been attributed to a fresh set of cyber attacks targeting South Korean military and corporate entities through March and April 2026 Kimsuky employed a range of tailored social engineering tactics such as spoofing security software installation pages and crafting a fake Webex meeting page that leveraged