Kimsuky's Advanced Attack Techniques: JSONPing, Webex Spoofing, and a New HttpSpy Variant

Kimsuky has deployed advanced malware campaigns against South Korean military and corporate targets using tailored social engineering methods including fake installation pages and Webex meeting spoofing. The threat actor introduced JSONPing, a technique that uses JSONP queries to localhost servers to confirm payload execution in real time. The new HttpSpy variant features a three-stage execution chain with RC4 encryption, replacing the prior single-binary design. Attribution is confirmed through multiple technical indicators such as code pattern overlaps, encryption key reuse, XAMPP certificate fingerprints, and ASN preferences consistent with historical Kimsuky activity. These campaigns are ongoing through April 2026 and focus on South Korean entities.

The campaigns enable Kimsuky to conduct targeted espionage against South Korean military and corporate organizations by deploying advanced malware with real-time payload verification and sophisticated execution chains. The use of social engineering and Webex spoofing increases the likelihood of successful victim compromise. The new HttpSpy variant's multi-stage execution and encryption techniques enhance stealth and persistence. There are no reports of widespread exploitation beyond these targeted campaigns.

No official patches or fixes are available as this is a malware campaign rather than a software vulnerability. Organizations should be aware of the social engineering tactics described, including fake security software pages and spoofed Webex meeting invitations. Monitoring for indicators of compromise related to Kimsuky, such as the use of JSONPing and the new HttpSpy variant, is recommended. Since the threat targets South Korean entities specifically, heightened vigilance in these sectors is advised. Patch status is not applicable; follow vendor and threat intelligence updates for any new mitigation guidance.