Kimsuky (aka Velvet Chollima), the North Korean state-sponsored APT attributed to the Reconnaissance General Bureau, conducted a focused campaign against South Korean military and corporate entities during March and April 2026. The campaign extended Kimsuky's toolset with three newly identified components: HTTPSpy, HelloDoor, and HttpMalice — while adding VS Code tunneling and Cloudflare Quick Tunnels as covert C2 channels.
Social engineering drove initial access. Attackers spoofed South Korean security software installation pages and created a fake Webex meeting page tied to a legitimate meeting schedule. Once delivered, HTTPSpy disguised itself as trusted Korean security software. HelloDoor — a Rust-compiled PebbleDash variant assessed to have been developed with LLM assistance — provides remote access capability with a smaller detection footprint than its predecessor.
The VS Code tunnel technique is particularly notable: Kimsuky leveraged legitimate VS Code Remote Tunneling combined with GitHub authentication, meaning C2 traffic rides on trusted Microsoft infrastructure. This materially degrades the effectiveness of domain/IP blocklists as a defensive layer.
◈ Table of Contents
Phase 1: Actor Profile
DPRK APT| Attribute | Detail |
|---|---|
| Name | Kimsuky (aka Velvet Chollima, Thallium, Black Banshee) |
| Origin | North Korea — Reconnaissance General Bureau |
| Active since | 2012 (known); this campaign: March–April 2026 |
| Primary mission | Intelligence collection, credential theft, GPKI certificate harvesting |
| Research sources | THN, SC Media, Enki White Hat, Securelist (Kaspersky) |
Phase 2: Targeting
VICTIMOLOGYSouth Korean Military
Korean military entities targeted with fake Webex lures referencing real scheduled meetings. Operational security content likely sought.
Corporate Sector
South Korean private-sector companies targeted alongside military. Likely focus on defense-industrial base and technology firms.
GPKI Certificate Holders
HappyDoor variant specifically targets GPKI (Government Public Key Infrastructure) certificates — high-value for impersonating Korean government identities.
Phase 3: Initial Access
SOCIAL ENGINEERINGThe use of a real meeting schedule as the lure context is significant — it requires prior intelligence about the target's calendar. Kimsuky likely obtained this via prior compromised email access or LinkedIn reconnaissance.
In South Korea, several government-mandated security software packages are required for internet banking and government portal access. Kimsuky exploits this known user behavior — targets are trained to accept these installs. Any installer arriving via email or web redirect should be verified against the official vendor download page.
Phase 4: Malware Arsenal
NEW TOOLS| Property | Value |
|---|---|
| Type | Information stealer |
| Delivery disguise | Korean security software installer |
| Communication | HTTPS to C2 |
| Predecessor | Earlier JSONPing-based HttpSpy variant |
| Property | Value |
|---|---|
| Language | Rust (compiled binary) |
| Lineage | PebbleDash variant |
| First seen | August 2025 |
| Dev assessment | Likely LLM-assisted code development |
| Capability | Remote access, post-compromise command execution |
GPKI certificate theft enables Kimsuky to impersonate Korean government entities in follow-on operations. Organizations holding GPKI credentials should audit certificate stores immediately and monitor for unauthorized certificate usage.
Phase 5: Persistence & C2 Channels
LIVING-OFF-THE-LAND- 1VS Code tunnel established — code.exe (VS Code CLI) run with
tunnelargument and authenticated via GitHub OAuth. - 2C2 traffic blends into Microsoft infra — Connections to
*.vscode.devand*.tunnels.api.visualstudio.comappear legitimate. - 3Cloudflare Quick Tunnel — Additional tunnel via Cloudflare for redundancy. Connections to
*.trycloudflare.com. - 4DWAgent deployed — Open-source RMM tool used for ongoing interactive access without custom tooling.
Blocking VS Code tunnels at the network level will break legitimate developer workflows. The correct response is behavioral detection: flag code.exe tunnel creation outside of known developer hosts, especially in non-developer environments like military or HR networks.
Phase 6: Detection Logic
HUNT QUERIESPriority alert: any instance of code.exe with the "tunnel" argument in a military, healthcare, finance, or government network segment should be treated as a presumed compromise until verified. VS Code Remote Tunneling is designed for developer workflows and should not appear on restricted-network endpoints.
Phase 7: MITRE ATT&CK Mapping
TECHNIQUE MAP| Tactic | ID | Technique | Tool/Evidence |
|---|---|---|---|
| Initial Access | T1566.003 | Spear-Phishing via Service | Fake Webex meeting page |
| Initial Access | T1566.001 | Spear-Phishing Attachment | Fake security software installer |
| Execution | T1204.002 | User Execution: Malicious File | HTTPSpy delivered as installer |
| Persistence | T1197 | BITS Jobs / Scheduled Tasks | RAT persistence mechanisms |
| C2 | T1572 | Protocol Tunneling | VS Code Remote Tunnel, Cloudflare Quick Tunnel |
| C2 | T1102 | Web Service | GitHub OAuth for VS Code tunnel auth |
| Collection | T1552.001 | Credentials In Files | HTTPSpy credential harvesting |
| Exfiltration | T1560 | Archive Collected Data | HappyDoor GPKI + data exfil |
| Defense Evasion | T1218 | System Binary Proxy Execution | Legitimate tools (DWAgent, code.exe) for C2 |
Sources & References
ATTRIBUTION🚨 HUNT FOR VSCODE TUNNEL ABUSE
VS Code tunnel-based C2 is appearing across multiple North Korean APT campaigns. Use CyberHawk's threat hunting resources to build detections for code.exe tunnel activity, cloudflared persistence, and DWAgent deployment in your environment.
→ View All APT Threat Profiles at cyberhawkthreatintel.com/threats
◈ Stay Connected
Follow CyberHawk Threat Intel for threat intelligence, deployment guides and hands-on SOC tooling content.
"They can't exploit you if you are the Exploit."