Kimsuky launches hyper-directed intrusion campaign with precise trickery and legitimate tools to steal data and control networks

A new cycle of intrusions attributed to the North Korean group known as Kimsuky (also Velvet Chollima) again highlights a recurring strategy: the combined use of highly targeted social engineering and legitimate tools to mask the delivery of sophisticated malware. During March and April 2026, campaigns were documented that supplanted security software installation pages and Webex rooms to force downloads that end up deploying variants of the HTTPSpy Trojan and other modular components that allow remote control and exfiltration.

The power of sectoral decoy and the personalization of deception is remarkable: one of the baits seemed specifically designed for business messaging administrators by imitating the installer of a B2B solution. Another took advantage of a real meeting schedule to create a fake Webex page to convince specific attendees. This type of precision indicates not only prior collection of information - possible commitment of accounts or devices - but also a clear intention to choose high-value victims within organizations.

From a technical point of view, attackers combined classic and more modern techniques: executable files calling regsvr32 to load an intermediate DLL (MemLoader.dll) that creates persistence by scheduled tasks, and JSE scripts that decompress and launch PowerShell downloads with anti-analysis checks before you recover the next stage. A mechanism called JSONPing is also documented, in which fake websites consult a local malware-mounted server to verify its real-time execution and display installation messages only if the binary is not running.

HTTPSpy which had already appeared in campaigns since 2022 and was associated by CrowdStrike to targets in Europe in 2024, acts here as the final payload in some incidents. Its capabilities include remote command execution, file transfer, screen capture, process injection and trace removal, i.e. all expected functions in a RAT designed for persistent espionage and information extraction.

In parallel, recent reports attributed to Kaspersky and other analysts show that Kimsuky evolves its infrastructure and tactics: abuse of legitimate tunnels by Visual Studio Code and Cloudflare Quick Tunnels to maintain access outside traditional channels, distribution of open remote management tools such as DWAgent, and use of Rust and language models to develop more agile variants. The clusters called PebbleDash and AppleSeed reflect this diversification, with families such as HelloDoor, HttpMalice, HttpTroy and variants focused on exfiltering sensitive data - including GPKI certificates - and advanced remote control.

Implications for organizations and managers are clear: we are facing a persistent and adaptable intelligence campaign with critical objectives (defense, government, energy, health, industry). The mixture of highly targeted baits, the theft of credentials / schedules and the use of legitimate tools for tunnels and remote control complicate traditional detection based only on signatures. In addition, when the attacker takes advantage of legitimate accounts to build confidence (for example, to distribute a link to a real meeting), external confidence-based controls become insufficient.

To reduce the attack surface and improve detection, it is a priority to tighten technical controls and operational processes. From the technical point of view it is appropriate to restrict the use of system utilities with abuse histories such as regsvr32, monitor and alert when rare processes create programmed tasks or install DLs via atypical executions, apply application control or white lists, limit the execution of scripts (JSE / PIF / SCR) and strengthen policies on PowerShell (registration, remote command blocking, AMSI). It is also critical to audit the use of remote tunnels and RMM tools in the network and, where possible, to disable or control the VS Code tunnel through corporate policies. Microsoft documents the operation of regsvr32 that helps to understand its abuse in intrusions: https: / / learn.microsoft.com / en-us / windows-server / administration / windows-commands / regsvr32, and the VS Code documentation on tunnels explains how these legitimate channels are established that can be abused: https: / / code.visualstudio.com / docs / remote / tunnels.

At the human and organizational level There are common sense measures that remain effective: educating users about the verification of download sources (download only from official portals or verified repositories), distrusting pop-ups that ask to run scripts to "fix" peripherals, review and harden access to privileged accounts (MFA, rotation of credentials, forced sessions), and review scheduled meetings and access delegates to detect anomalies that might indicate compromised accounts. For system administrators, reviewing mail logs and calendars in search of unusual reshipments or accesses can help to identify whether schedule or invitations were exfiltered.

If an intrusion is suspected, the response should include isolation of the affected endpoint, memory capture and disk dumping for forensic analysis (especially to recover DLs in memory and devices loaded with regsvr32 or PowerShell), collection of programmed tasks, related log keys, and network records to identify C2. Changing passwords, revoking committed tokens and reviewing GPKI certificates and their possible extraction are critical steps in environments where this infrastructure is managed.

Finally, the recommendation for security teams is to maintain proactive surveillance of IOCs and emerging tactics, share findings with the community and detection providers, and prioritize controls that limit both the attack surface and the ability of operators to use legitimate channels for their benefit. These adversaries have demonstrated the ability to adapt their technical and operational arsenal; effective defence requires combining behavior-based detection, platform hardening and agile response processes.