Kimsuky Uses Diplomat Impersonation to Deploy PebbleDash and PrxClient
Summary
AhnLab details Kimsuky spear-phishing attacks targeting foreign-affairs personnel with malicious LNK files that deploy PebbleDash, PrxClient, RDP tools, keyloggers and other malware to control systems and steal information.
Key points
- The 2026 spear-phishing campaigns impersonated diplomatic personnel and used decoy documents to persuade targets to open malicious LNK files.
- The LNK files launched PowerShell or embedded HTA scripts that installed downloaders and scheduled tasks for further payload execution.
- PebbleDash provided remote control, including command execution, file transfer, system and process information collection, and file deletion.
- Attackers enabled RDP using RDP Wrapper and backdoor accounts; a patched termsrv.dll enabled multiple concurrent sessions.
- PrxClient relayed traffic between attacker-controlled servers and local RDP ports, supporting remote access to compromised systems.
- Additional tools included UAC bypass utilities, keyloggers that uploaded captured keystrokes, and scripts that collected or exfiltrated local files.
- AhnLab advises caution with email attachments and executables from unknown sources and recommends keeping its V3 security product updated.
Article Details
- Attack Vectors
- Spear-phishing emails impersonating diplomatic personnel used LNK files disguised as documents to launch malicious scripts and install additional payloads.
- A malicious HTA script embedded in an LNK file was executed through Mshta.
- RDP access was enabled using RDP Wrapper and backdoor accounts; an RDP patcher modified termsrv.Dll to support multiple sessions.
- PrxClient relayed traffic between a C&C server and a local port, reportedly to enable RDP control.
- Defensive Notes
- Exercise caution with email attachments and executable files from unknown sources.
- Update V3 to the latest version.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | edcvbgtrf[.]medianewsonline[.]com | Domain hosting attack-related executable and RDP Wrapper files listed as IOCs. |
| DOMAIN | fsfhsfgsfsnxcvbasfsgsrhsf234fsd[.]mywebcommunity[.]org | Domain listed in the article's threat IOC section. |
| DOMAIN | mpo4wj[.]scienceontheweb[.]net | Domain listed in the article's threat IOC section. |
| DOMAIN | ng[.]mofagov[.]com | Domain listed in the article's threat IOC section. |
| DOMAIN | p563q1[.]sportsontheweb[.]net | Domain listed in the article's threat IOC section. |
| IPV4 | 103[.]212[.]120[.]253 | IP address listed in the article's threat IOC section. |
| IPV4 | 153[.]75[.]233[.]17 | C&C IP passed as an argument to PrxClient in observed attack commands and listed as an IOC. |
| IPV4 | 173[.]214[.]170[.]58 | C&C IP passed as an argument to PrxClient in an observed attack command and listed as an IOC. |
| MD5 | 00f27b3cf8817313aafdfc29ff238153 | MD5 listed in the article's malware-related IOC section. |
| MD5 | 029db651367bb1eac0a85bd826afe420 | MD5 listed in the article's malware-related IOC section. |
| MD5 | 07010ef323ff1a6efebf9c59f8afb35f | MD5 listed in the article's malware-related IOC section. |
| MD5 | 0a5f8bb2aebb296b6a5048ca5b85d8ad | MD5 listed in the article's malware-related IOC section. |
| MD5 | 0c0a44de58b0a47b749411a9c2fe178e | MD5 listed in the article's malware-related IOC section. |
| URL | hxxp[:]//167[.]88[.]165[.]122/login[.]asp | URL listed in the article's threat IOC section as attack-related infrastructure. |
| URL | hxxp[:]//edcvbgtrf[.]medianewsonline[.]com/1t32[.]exe | Malicious executable URL listed in the article's threat IOC section. |
| URL | hxxp[:]//edcvbgtrf[.]medianewsonline[.]com/rdpwrap[.]bat | RDP Wrapper batch-file URL listed in the article's threat IOC section. |
| URL | hxxp[:]//edcvbgtrf[.]medianewsonline[.]com/rdpwrap[.]dll | RDP Wrapper DLL URL listed in the article's threat IOC section. |
| URL | hxxp[:]//edcvbgtrf[.]medianewsonline[.]com/rpc[.]exe | Executable URL listed in the article's threat IOC section. |
MITRE ATT&CK
T1005 · Data from Local SystemThe capture.Ps1 script read locally stored files before transmitting them to the C&C server.T1021.001 · Remote Desktop ProtocolThe attackers used RDP to control infected systems.T1041 · Exfiltration Over C2 ChannelCollected files and keylogger data were transmitted to the C&C server.T1053.005 · Scheduled TaskThe attack registered launcher scripts as a scheduled task named Windows Templates Update.T1055 · Process InjectionThe PebbleDash injector injected the malware into the LSASS process.T1056.001 · KeyloggingA keylogger stored users' keystrokes and sent them to the C&C server.T1059.001 · PowerShellPowerShell scripts were used as droppers and to execute obfuscated commands.T1105 · Ingress Tool TransferThe DefenderUpdate.Js downloader retrieved and executed additional payloads from the C&C server.T1136.001 · Local AccountThe attackers created backdoor Windows accounts, including adminini.T1204.002 · Malicious FileThe LNK malware runs when a recipient executes the attachment.T1218.005 · MshtaAn LNK launched Mshta to execute an embedded malicious HTA script.T1548.002 · Bypass User Account ControlUACMe and SspiUacBypass tools were used for UAC bypass.T1566.001 · Spearphishing AttachmentThe group used spear-phishing attacks with document-disguised LNK attachments.
Threat Actors
Malware
Products
Microsoft WindowsThe script executed through Mshta acts as a dropper; it creates “%APPDATA%\Microsoft\Windows\Templates\Templates.Js,” which serves as the launcher, and “%APPDATA%\Microsoft\Windows\Templates\Templates.Ps1,” which theV3Also, V3 should be updated to the latest version so that malware infection can be prevented.
Tools
RDP PatcherThe threat actor also used an RDP Patcher, which reads the existing legitimate “termsrv.Dll,” saves the patched version to the “C:\temp.Dll” Path, and then replaces the “termsrv.Dll” file in the System32 directory withRDP Wrappermalware in a post titled “Analysis of the Kimsuky Group’s Latest Attacks Exploiting PebbleDash and RDP Wrapper” [1].SspiUacBypassThe SspiUacBypass [2] project is a tool that uses a technique to bypass UAC by manipulating the NTLM Datagram Context of SSPI.UACMEThese spear phishing attacks utilize LNK malware to install various tools, including the PebbleDash backdoor, the PrxClient proxy malware, RDP Wrapper, UACMe, and KeyLogger.