North Korean cyber group Kimsuky adopts new HTTPSpy spyware

Attacks attributed to Kimsuky in March and April 2026 targeted South Korean military and corporate entities. The actor distributed HTTPSpy malware through spoofed South Korean security-software installation pages and a fake Cisco Webex page.