Kimsuky, a North Korean state-sponsored threat group, conducted targeted intrusion campaigns against South Korean military, corporate, and government organizations between March and April 2026. The group introduced two new malware families and adopted tactics that hide malicious traffic inside legitimate tools, Microsoft VS Code, Cloudflare tunnels, and spoofed installers for trusted South Korean software, making detection significantly harder with standard controls. Organizations with South Korean business ties, defense-industrial supply chains, or operations in the region face elevated risk of undetected, long-dwell intrusions.