Loading malware…
HTTPSpy is a remote access trojan (RAT) associated with the DPRK-linked threat actor Kimsuky and used in campaigns targeting South Korean military and corporate organizations; reporting also notes prior targeting of a German defense manufacturer. The malware has been delivered through tailored social-engineering lures, including counterfeit Cisco Webex meeting pages and fake security software installer pages. In the April 2026 campaign described in the content, a fake Webex page prompted victims to download and run an encrypted JavaScript/JSE file (fix-camera.jse), which dropped and executed a staged infection chain: a downloader DLL with export name loadDll.dll, a second-stage installer component identified as spyInster.dll (engine.dat), a loader component cacheMon.dat with export name spyLoader.dll, and the final in-memory payload httpSpy.dll. The lure also dropped meeting.html to redirect victims to a legitimate Webex meeting room, and the campaign reportedly used real meeting details, suggesting prior compromise of a participant account or device. HTTPSpy uses a multi-stage architecture, anti-analysis and anti-VM checks, RC4-encrypted payloads and configuration data, and persistence via the Windows Run key; related reporting also notes a Windows service named CacheDB in similar threats. The malware communicates with command-and-control infrastructure over HTTP/HTTPS using HTTP POST and RC4-encrypted, Base64-encoded data, with parameters including _sessionchk, _logininfo, _pkgparam, and _lockdata. A reported primary C2 URL was hxxp://hdrgdrfes[.]chickenkiller[.]com/index.php. Documented capabilities include shell command execution, file upload and download, hidden process execution, screenshot capture, configuration updates, timestomping, self-uninstall/erasure, and remote DLL injection into specified processes. Additional campaign infrastructure included hxxps://conference.birdriver[.]org/ and hxxps://download.birdriver[.]org/download.php?id=425623 and ?id=393156. The content also links the broader campaign to Kimsuky’s JSONPing technique, in which malicious pages query a localhost server deployed by the malware to verify execution status.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Executing the downloaded jse file ultimately installs an HttpSpy variant on the system... The final payload is a RAT with the export name httpSpy.dll.
28 distinct techniques documented for this family, organized by ATT&CK tactic.
For instance, operators can execute shell commands, take system screenshots, or manipulate local documents remotely.
For all other commands, it executes them via cmd.exe /c , redirects standard output to a temporary file matching %TEMP%\NK[0-9a-fA-F]+\.tmp , collects the output, and sends it to the C&C server.
在根目录 site-packages 生成 package.pth import base64; exec(base64.b64decode('...').decode('utf-8'))
fix-camera.jse 는 base64 인코딩 상태로 포함된 악성코드와 미끼 html 파일을 각각 ... 생성하고 실행한다.
jse 스크립트는 base64 인코딩 된 데이터를 쓰레기 변수에 할당하거나, 문자열을 슬라이싱 해 "+" 연산으로 조합하는 등 여러 난독화 방식이 적용되어 있다.
engine.dat decrypts an embedded RC4-encrypted payload and drops it to C:\Users\Public\cacheMon.dat . It then RC4-decrypts the configuration data and appends it to cacheMon.dat as a DATA_CONF alternate data stream (ADS).
| DLL | Admin | ChromeUpdate | Uses regsvr32 + highest privileges | ... | EXE | User | EdgeUpdate | Direct execution
이중 base64 인코딩 된 악성코드는 1회 디코딩 후 C:\ProgramData\mTXDZew.sz8f 으로 생성되고, certutil로 다시 디코딩되어 최종적으로 C:\ProgramData\mTSTCv8.mdxm 파일로 저장된다.
In its main loop, the malware loads the C&C server URL ... and receives remote commands via HTTP POST.
If a proxy address is set at offset +0x410 (1040) in the configuration file, communication is routed through that proxy, with 2[.]2[.]2[.]2 used as the proxy bypass address.
31 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Remote access trojan installed through a multi-stage chain. It communicates with a C2 over HTTP POST, supports shell command execution, file upload/download, screenshot capture, configuration updates, proxy use, self-deletion, and remote DLL injection.
Fake Webex meeting pages deliver a multi-stage loader chain that ultimately installs a HttpSpy variant. The RAT communicates with C2 over HTTP POST, supports command execution, file download/upload, screenshot capture, configuration updates, proxy use, timestomping, self-delete, and remote DLL injection, and persists via a Run key invoking regsvr32 on cacheMon.dat.
A Kimsuky-associated remote access trojan used in cyber espionage campaigns. The described variant uses a three-stage chain consisting of an installer, a stealth loader, and the core RAT module. It performs environment checks, downloads the primary implant, executes shell commands, captures screenshots, manipulates local documents remotely, and communicates over HTTP POST with RC4-encrypted data transmission.
Remote access trojan used by Kimsuky, delivered via spoofed security software installers and fake Webex pages to provide covert access to victim systems.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.