Kimsuky’s “HttpTroy” – A Fake VPN Invoice with a Real Backdoor A new threat actor playbook has emerged from North Korea’s shadowy cyber-espionage operations. In early November 2025, researchers revealed that the DPRK-linked group Kimsuky (aka Velvet Chollima or Thallium)