Kimsuky Deploys HTTPSpy, Expands Arsenal with HelloDoor and VS Code Tunnels

This article analyzes Kimsuky's sophisticated cyber attacks against South Korean military and corporate entities, focusing on their deployment of HTTPSpy malware and new tools like HelloDoor and VS Code tunneling.

• •Kimsuky uses social engineering tactics including spoofed security software pages and fake Webex meetings to deliver HTTPSpy, a remote access trojan with capabilities for shell commands, file uploads/downloads, screenshots, and DLL injection
• •In March 2026, attackers used a bogus B2B messaging service installer page distributing executables that launch MemLoader.dll via regsvcs.exe and establish persistence through scheduled tasks
• •April 2026 campaign exploited Webex pages with malicious JavaScript files (fix-camera.jse) that download intermediate downloaders leading to HTTPSpy deployment
• •HelloDoor is a Rust-based malware variant developed using LLMs that supports basic command execution and directory management