Kimsuky Uses Fake Security and Webex Lures to Deploy HTTPSpy
Summary
ENKI described Kimsuky campaigns targeting South Korean organizations with fake security-software and Webex lures that delivered HTTPSpy and other payloads. Kaspersky also reported expanded use of malware, remote-access tools and VS Code tunneling.
Key points
- ENKI reported that fake security-software pages delivered malicious installers that launched a DLL, established persistence, and contacted a command-and-control server.
- In an April 2026 campaign, a counterfeit Webex page led victims to run a script that ultimately deployed HTTPSpy, a RAT with command execution, file-transfer and screenshot capabilities.
- ENKI described JSONPing, which checks malware execution through a local server and can show an installation prompt when the malware is not running.
- ENKI said a fake meeting page used a legitimate Webex meeting schedule; it assessed that the schedule may have been obtained by compromising a service member’s device or account.
- Kaspersky reported Kimsuky’s use of VS Code Remote Tunneling and DWAgent for covert access and post-exploitation activity.
- Kaspersky described HelloDoor and HttpMalice among the group’s malware, and reported that AppleSeed activity includes GPKI certificate harvesting.
Article Details
- Attack Vectors
- Fake South Korean security-software installation pages distributed malicious installers disguised as nProtect Online Security and AhnLab Safe Transaction.
- A counterfeit Webex meeting page prompted victims to run a script, leading to an encrypted JSE file and a multi-stage malware infection.
- The attackers used a stolen meeting schedule to make a fake meeting page appear relevant to attendees.
- JSONPing queried a local server on the victim's machine to check whether malware was running and tailor the installation prompt.
- Kimsuky used VS Code tunneling and DWAgent for covert access and post-exploitation activity.
MITRE ATT&CK
T1005 · Data from Local SystemAppleSeed Spy gathers documents and data from the C:GPKI directory.T1036 · MasqueradingMalicious installers were disguised as nProtect Online Security and AhnLab Safe Transaction; a separate page impersonated Webex.T1053.005 · Scheduled TaskMemLoader.dll established persistence on the host using a scheduled task.T1055 · Process InjectionHTTPSpy can inject DLL paths into specified PID processes.T1056.001 · KeyloggingThe AppleSeed Spy variant gathers keystrokes.T1059.001 · PowerShellPowerShell ran the intermediate downloader mTSTCv8.mdxm.T1059.007 · JavaScriptThe infection chain executed the encrypted JSE file fix-camera.jse.T1105 · Ingress Tool TransferThe malware contacted C2 servers to retrieve payloads, including the next-stage malware in the Webex lure chain.T1113 · Screen CaptureHTTPSpy and several other described malware families can capture screenshots.T1218.010 · Regsvr32The first-stage executables launched MemLoader.dll using regsvr32.exe.T1219 · Remote Access ToolsKimsuky distributed DWAgent for post-exploitation remote monitoring and management.T1572 · Protocol TunnelingKimsuky abused VS Code Remote Tunneling to establish covert remote access to victim devices.
People
Threat Actors
Malware
AppleseedKaspersky also reported that Kimsuky is evolving its toolset with VS Code tunneling, DWAgent, and new malware families including HelloDoor, HttpMalice, HttpTroy, AppleSeed, and HappyDoor.HappyDoorKaspersky also reported that Kimsuky is evolving its toolset with VS Code tunneling, DWAgent, and new malware families including HelloDoor, HttpMalice, HttpTroy, AppleSeed, and HappyDoor.HelloDoorKaspersky also reported that Kimsuky is evolving its toolset with VS Code tunneling, DWAgent, and new malware families including HelloDoor, HttpMalice, HttpTroy, AppleSeed, and HappyDoor.HttpMaliceKaspersky also reported that Kimsuky is evolving its toolset with VS Code tunneling, DWAgent, and new malware families including HelloDoor, HttpMalice, HttpTroy, AppleSeed, and HappyDoor.HTTPSpySouth Korean military and corporate entities with fake security software and Webex lures to deliver HTTPSpy and other payloads, while using techniques like JSONPing and stolen meeting schedules to improveHttpTroyKaspersky also reported that Kimsuky is evolving its toolset with VS Code tunneling, DWAgent, and new malware families including HelloDoor, HttpMalice, HttpTroy, AppleSeed, and HappyDoor.PebbleDashAttack chains have been found to rely on a variety of droppers written in JSE, PIF, SCR, and EXE to deliver two broad malware families: PebbleDash and AppleSeed.
Products
AhnLab Safe Transaction (ASTx)– “nos-setup.exe” and “astx-setup.exe” – that masquerade as nProtect Online Security and AhnLab Safe Transaction (ASTx).Cisco WebExIn another campaign observed in April 2026, a counterfeit web page mimicking Cisco Webex is said to have been used to display a pop-up message urging the victim to download and run a script to address issues withCloudflare Quick TunnelsKaspersky detailed the threat actor’s use of Microsoft Visual Studio Code (VS Code) tunneling, Cloudflare Quick Tunnels, DWAgent, large language models (LLMs), and the Rust programming language in its latestDWAgentKaspersky also reported that Kimsuky is evolving its toolset with VS Code tunneling, DWAgent, and new malware families including HelloDoor, HttpMalice, HttpTroy, AppleSeed, and HappyDoor.nProtect Online Securityof either of the two executables – “nos-setup.exe” and “astx-setup.exe” – that masquerade as nProtect Online Security and AhnLab Safe Transaction (ASTx).VSCodeThe disclosure comes as Kaspersky detailed the threat actor’s use of Microsoft Visual Studio Code (VS Code) tunneling, Cloudflare Quick Tunnels, DWAgent, large language models (LLMs), and the Rust programming language
Tools
Countries
BrazilWhile PebbleDash attacks have also been recorded against defense organizations in Brazil and Germany, the AppleSeed cluster has mainly targeted government organizations.GermanyWhile PebbleDash attacks have also been recorded against defense organizations in Brazil and Germany, the AppleSeed cluster has mainly targeted government organizations.South Korea“These activities affected various sectors in South Korea, impacting both public and private entities.”
Industries
DefenseIn its 2025 European Threat Landscape Report, CrowdStrike said the hacking group likely targeted a German defense manufacturer’s employees via a credential phishing campaign deploying the malware between May 2024 and atEnergy“Two clusters have overlapping target sectors that span the defense, military, government, medical, machinery, and energy industries.”GovernmentWhile PebbleDash attacks have also been recorded against defense organizations in Brazil and Germany, the AppleSeed cluster has mainly targeted government organizations.Machinery“Two clusters have overlapping target sectors that span the defense, military, government, medical, machinery, and energy industries.”Medical“Two clusters have overlapping target sectors that span the defense, military, government, medical, machinery, and energy industries.”MilitaryKimsuky targeted South Korean military and corporate entities with fake security software and Webex lures to deliver HTTPSpy and other payloads, while using techniques like JSONPing and stolen meeting schedules to