South Korean military and corporate entities

Date (as written): 2026-05-27
Year: 2026
Country: KR
Actors (as written): Kimsuky (aka Velvet Chollima, North Korea)
Actor pages: Kimsuky
Tags (as written): Attack: Malware; Attack Class: Cyber Espionage

Source entries (2)

Hackmageddon cyber attacks timelines (Paolo Passeri)

South Korean military and corporate entities · 2026-05-27

Researchers at ENKI discover North Korea's Kimsuky targeting South Korean military/corporate via fake security software installation pages and fake Webex meeting pages to deliver HTTPSpy and new tools HelloDoor and VS Code Tunnels. [Date Occurred: During April 2025; Date Discovered: During April 2025]

https://www.hackmageddon.com/2026/06/09/16-31-may-2026-cyber-attacks-timeline/

https://thehackernews.com/2026/05/kimsuky-deploys-httpspy-expands-arsenal.html

Dailysecu 데일리시큐 (dailysecu.com)

북한 해킹조직 킴수키, 3월과 4월 한국 군·기업 겨냥 신종 공격 정황 포착 · 2026-05-30

attribution sentence(s): 북한 해킹조직 킴수키(Kimsuky)가 한국 군·기업 관계자를 겨냥해 보안 프로그램 설치 페이지와 화상회의 서비스를 사칭한 정교한 공격을 벌인 것으로 확인됐다. | [KCSCON 2026] 2026년 Kimsuky의 스피어피싱·지속성 전략 -엔키화이트햇 위협연구팀 김영운-

https://www.dailysecu.com/news/articleView.html?idxno=206971

Suggest a correction on GitHub