Between March and April 2026, the North Korean state-sponsored group Kimsuky (also tracked as Velvet Chollima) [ran a targeted campaign](https://thehackernews.com/2026/05/kimsuky-deploys-httpspy-expan