Kimsuky Expands PebbleDash and AppleSeed Operations With New Malware and Remote-Access Tools
Summary
Kaspersky details Kimsuky campaigns using evolving PebbleDash and AppleSeed malware, phishing droppers, and legitimate VSCode tunneling and DWAgent for persistence and remote access, mainly against South Korean targets.
Key points
- Spear-phishing emails and, in some cases, messenger contact delivered malicious attachments and droppers in JSE, PIF, SCR, and EXE formats.
- The analysis covers PebbleDash variants HelloDoor, httpMalice, MemLoad, and httpTroy, alongside AppleSeed and HappyDoor.
- httpMalice profiles infected systems, executes commands, captures screenshots, and maintains persistence through a Windows service or registry autorun entry.
- Kimsuky used Visual Studio Code Remote Tunneling and DWAgent for covert remote access, including GitHub authentication for VSCode tunnels.
- AppleSeed’s Spy variant collects documents, screenshots, keystrokes, and USB-drive lists; version 2.1 also collects the GPKI directory.
- Targets are concentrated in South Korea, with PebbleDash activity also observed in Brazil and Germany and interest in defense organizations.
- Shared droppers, stolen certificates, mutex patterns, and overlapping targets support the researchers’ assessment that the clusters are Kimsuky-affiliated.
Article Details
- Attack Vectors
- Spear-phishing emails and, in some cases, messenger contact delivered malicious attachments disguised as documents, installers, surveys, or photos.
- JSE, EXE, PIF, and SCR droppers decoded or decrypted payloads and launched malware such as PebbleDash- and AppleSeed-cluster malware.
- Some droppers downloaded the legitimate Visual Studio Code CLI and used Remote Tunneling with GitHub authentication to enable remote access to infected devices.
- Kimsuky deployed DWAgent through compressed packages or a separate installer to provide remote control of compromised hosts.
- The campaigns used attacker C2 domains, compromised South Korean websites, and tunneling services to conceal or relay C2 activity.
- Defensive Notes
- Monitor JSE droppers that decode Base64 content or invoke hidden PowerShell with certutil, and watch for subsequent regsvr32.exe or rundll32.exe execution.
- Review unexpected Run-key entries, scheduled tasks named ChromeCheck or EdgeCheck, and Windows services named CacheDB.
- Investigate unauthorized Visual Studio Code Remote Tunneling and DWAgent installations, including unexpected tunnel creation and Slack webhook activity.
- Hunt for HTTP/HTTPS POST traffic associated with the listed C2 indicators and for unexpected transfers of screenshots, archived directories, or host-profile data.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | attach[.]docucloud[.]o-r[.]kr | Listed as a MemLoad C2 domain. |
| DOMAIN | cms[.]spaceyou[.]o-r[.]kr | Listed as a HappyDoor C2 domain. |
| DOMAIN | erp[.]spaceme[.]p-e[.]kr | Listed as a HappyDoor C2 domain. |
| DOMAIN | female-disorder-beta-metropolitan[.]trycloudflare[.]com | HelloDoor C2 hosted through TryCloudflare. |
| DOMAIN | file[.]bigcloud[.]n-e[.]kr | httpTroy C2 domain. |
| DOMAIN | load[.]auraria[.]org | Listed as an httpTroy C2 domain. |
| DOMAIN | load[.]erasecloud[.]n-e[.]kr | Listed as a MemLoad C2 domain. |
| DOMAIN | load[.]ssangyongcne[.]o-r[.]kr | Listed as a MemLoad C2 domain. |
| DOMAIN | load[.]supershop[.]o-r[.]kr | Listed as a MemLoad C2 domain. |
| DOMAIN | load[.]yju[.]o-r[.]kr | Listed as a MemLoad C2 domain. |
| DOMAIN | morames[.]r-e[.]kr | Listed as an AppleSeed C2 domain. |
| DOMAIN | opedromos1[.]r-e[.]kr | Listed as an AppleSeed C2 domain. |
| MD5 | 52f1ff082e981cbdfd1f045c6021c63f | Hash of a JSE dropper deploying httpMalice. |
| MD5 | 58ac2f65e335922be3f60e57099dc8a3 | Hash of MemLoad malware. |
| MD5 | 5c373c2116ab4a615e622f577e22e9be | Hash of an AppleSeed Dropper. |
| MD5 | 65fc9f06de5603e2c1af9b4f288bb22c | Hash of a Reger Dropper that deployed MemLoad and httpTroy. |
| MD5 | 7e0825019d0de0c1c4a1673f94043ddb | Hash of the httpTroy backdoor. |
| MD5 | 8983ffa6da23e0b99ccc58c17b9788c7 | Hash of a Pidoc Dropper that deployed HappyDoor. |
| MD5 | 995a0a49ae4b244928b3f67e2bfd7a6e | Hash of a JSE dropper deploying HelloDoor. |
| MD5 | 9ca5f93a732f404bbb2cee848f5bbda0 | Hash of the VSCode Tunnel installer. |
| MD5 | a7f0a18ac87e982d6f32f7a715e12532 | Hash of an AppleSeed Dropper. |
| MD5 | c19aeaedbbfc4e029f7e9bdface495b9 | Hash of a Reger Dropper. |
| MD5 | c42ae004badddd3017adadbdd1421e00 | Hash of HelloDoor malware. |
| MD5 | d1ec20144c83bba921243e72c517da5e | Hash of HappyDoor malware. |
| MD5 | f4465403f9693939fe9c439f0ab33610 | Hash of an AppleSeed Dropper. |
| MD5 | f73ba062116ea9f37d072aa41c7f5108 | Hash of MemLoad malware. |
| SHA256 | 08160acf08fccecde7b34090db18b32194faed9af49c98a89c8acc55e97276c9 | Hash listed for httpMalice. |
| URL | hxxp[:]//newjo-imd[.]com/common/include/library/default.php | Listed as an httpMalice C2 endpoint. |
| URL | hxxps[:]//www[.]pyrotech[.]co[.]kr/common/include/tech/default.php | Listed as an httpMalice C2 endpoint. |
| URL | hxxps[:]//www[.]yespp[.]co[.]kr/common/include/code/out[.]php | Specific endpoint on a compromised South Korean website used to send VSCode tunnel details. |
MITRE ATT&CK
T1005 · Data from Local SystemAppleSeed collected documents, screenshots, keystrokes, USB-drive lists, and GPKI-related data from infected systems.T1027 · Obfuscated Files or InformationDroppers concealed payloads with Base64, XOR encryption, dummy data, and encrypted strings.T1041 · Exfiltration Over C2 ChannelhttpMalice sent host-profile data, screenshots, and archived directories through its C2 channel.T1053.005 · Scheduled TaskMemLoad established persistence by creating scheduled tasks named ChromeCheck or EdgeCheck.T1059.001 · PowerShellA payload invoked hidden PowerShell with certutil to decode a file before execution.T1059.007 · JavaScriptJSE droppers used JScript to decode and write lure files and malicious payloads.T1071.001 · Web ProtocolsHelloDoor and httpMalice communicated with C2 over HTTP or HTTPS.T1090 · ProxyThe campaigns used Cloudflare Quick Tunnels, VSCode Tunneling, and Ngrok to conceal or relay infrastructure.T1105 · Ingress Tool TransferMemLoad downloaded httpTroy, and the VSCode installer downloaded the VSCode CLI.T1113 · Screen CapturehttpMalice captured screenshots and sent them to its C2 server.T1204.002 · Malicious FileThe campaign relied on recipients opening malicious attachments disguised as documents, installers, and other lures.T1218.010 · Regsvr32Droppers and implants used regsvr32.exe to execute malware.T1543.003 · Windows ServicehttpMalice created a Windows service named CacheDB for persistence.T1547.001 · Registry Run Keys / Startup FolderHelloDoor and httpMalice registered persistence entries under the Windows Run key.T1566.001 · Spearphishing AttachmentKimsuky delivered malicious attachments disguised as documents through spear-phishing emails.
Threat Actors
KimsukyThe report assesses with medium-high confidence that the PebbleDash- and AppleSeed-associated attacks were conducted by Kimsuky-affiliated clusters; it attributes spear-phishing, malware deployment, and post-exploitation activity to Kimsuky.Ruby SleetThe article identifies Ruby Sleet as an alias for Kimsuky and notes that Microsoft uses this name for Kimsuky activity; the campaign attribution is assessed with medium-high confidence.Sparkling PiscesThe article identifies Sparkling Pisces as an alias for Kimsuky, which it links with medium-high confidence to the reported campaign activity.SpringtailThe article identifies Springtail as an alias for Kimsuky, which it links with medium-high confidence to the reported campaign activity.Velvet ChollimaThe article identifies Velvet Chollima as an alias for Kimsuky, which it links with medium-high confidence to the reported campaign activity.
Malware
AppleseedKimsuky has evolved its PebbleDash and AppleSeed malware clusters with new variants, legitimate tooling like VSCode Tunneling and DWAgent, and infrastructure that hides C2 activity across South Korea and beyond.HappyDoor#KimsukyHelloDoor#KimsukyHttpMalice#KimsukyHttpTroy#KimsukyMemLoad[T1053.005 ] Scheduled Task – MemLoad created scheduled tasks for persistence (‘schtasks /create /tn /tr “regsvr32 /s “‘).PebbleDashKimsuky has evolved its PebbleDash and AppleSeed malware clusters with new variants, legitimate tooling like VSCode Tunneling and DWAgent, and infrastructure that hides C2 activity across South Korea and beyond.
Vendors
CloudflareInfrastructure frequently used free South Korean hosting, hacked websites, and tunneling services such as Cloudflare Quick Tunnels and Ngrok.DropboxOur analysis revealed two distinct versions of httpMalice based on their C2 communications: version 1.9 communicates over HTTP and version 1.8 uses Dropbox.DWServiceFinally, it executes the commands necessary to install DWService as a service on the target host:GitHubFor VSCode, the attacker uses GitHub authentication method.MicrosoftThe Remote Tunneling feature in VSCode supports establishing a tunnel using either a Microsoft or GitHub account.NgrokInfrastructure frequently used free South Korean hosting, hacked websites, and tunneling services such as Cloudflare Quick Tunnels and Ngrok.Slack[T1102.001 ] Web Service: Web Service – VSCode tunnel URLs were sent to external services and Slack webhooks (‘sent to a Slack channel via a WebHook’).
Products
DWAgentKimsuky has evolved its PebbleDash and AppleSeed malware clusters with new variants, legitimate tooling like VSCode Tunneling and DWAgent, and infrastructure that hides C2 activity across South Korea and beyond.VSCodePost-exploitation activity increasingly relied on legitimate tools, including Visual Studio Code Remote Tunneling and DWAgent, to reduce detection.
Tools
DWAgentKimsuky has evolved its PebbleDash and AppleSeed malware clusters with new variants, legitimate tooling like VSCode Tunneling and DWAgent, and infrastructure that hides C2 activity across South Korea and beyond.VSCode CLI[T1105 ] Ingress Tool Transfer – Payloads and tools such as VSCode CLI and DWAgent were downloaded from remote servers (‘downloads a legitimate Visual Studio Code (VSCode) CLI onto the infected device’).
Countries
BrazilTargets were concentrated in South Korea, but PebbleDash activity was also observed in Brazil and Germany, with strong interest in defense and government sectors.GermanyTargets were concentrated in South Korea, but PebbleDash activity was also observed in Brazil and Germany, with strong interest in defense and government sectors.South KoreaKimsuky has evolved its PebbleDash and AppleSeed malware clusters with new variants, legitimate tooling like VSCode Tunneling and DWAgent, and infrastructure that hides C2 activity across South Korea and beyond.
Industries
Constructionhow the malware was distributed by replacing a security software installer required to access a construction entity’s website.DefenseThe campaign used spear-phishing, droppers, and post-exploitation tools to maintain persistence, steal information, and expand access while targeting government, defense, medical, and other sectors.EnergyTwo clusters have overlapping target sectors that span the defense, military, government, medical, machinery, and energy industries.GovernmentThe campaign used spear-phishing, droppers, and post-exploitation tools to maintain persistence, steal information, and expand access while targeting government, defense, medical, and other sectors.MachineryTwo clusters have overlapping target sectors that span the defense, military, government, medical, machinery, and energy industries.MedicalThe campaign used spear-phishing, droppers, and post-exploitation tools to maintain persistence, steal information, and expand access while targeting government, defense, medical, and other sectors.MilitaryThe PebbleDash cluster has shown a particular interest in the medical, military and defense industries worldwide.