DPRK-Aligned Campaign Targets South Korea With VS Code Tunnels for Remote Access
Summary
Darktrace describes a campaign targeting South Korea that uses government-themed decoys and JSE scripts to establish VS Code tunnels for remote access. The activity is assessed as DPRK-aligned, though attribution is not definitive.
Key points
- A JSE file disguised as a Hangul document, likely delivered by spear-phishing, launches through Windows Script Host.
- Government-themed decoy documents impersonate South Korea’s Ministry of Personnel Management.
- The script downloads VS Code components and starts a tunnel named “bizeugene,” enabling interactive remote access.
- Attackers authorize the tunnel through a GitHub device code; access to the terminal and file browser can support payload retrieval and data exfiltration.
- A compromised South Korean website is used as a command-and-control server.
- Darktrace says the activity is consistent with DPRK-aligned tactics but notes the sample alone does not establish definitive attribution.
Article Details
- Attack Vectors
- A likely spear-phishing email delivers a JSE file disguised as a Hangul Word Processor document, accompanied by government-themed decoy documents impersonating South Korea’s Ministry of Personnel Management.
- The JSE script uses Base64-encoded content and Windows Script Host, downloads VS Code CLI archives and the legitimate VS Code executable, then starts a VS Code tunnel to provide remote interactive access.
- The tunnel code and token are sent in a POST request to a compromised South Korean website used as a command-and-control server.
- Defensive Notes
- Monitor for unexpected execution of JSE files by Windows Script Host, including scripts that launch downloaded VS Code components.
- Monitor for unexpected VS Code tunnel creation and remote access, particularly on systems where developer tools are not normally used.
- Investigate suspicious outbound requests to compromised infrastructure and review VS Code Server logs and tunnel authorization activity.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | www[.]yespp[.]co[.]kr | Compromised South Korean site used as a command-and-control server. |
| IPV4 | 115[.]68[.]110[.]73 | IP address of the compromised site used as a command-and-control server. |
| MD5 | 9fe43e08c8f446554340f972dac8a68c | Hash listed for the JSE file disguised as a Hangul document. |
| URL | hxxps[:]//www[.]yespp[.]co[.]kr/common/include/code/out[.]php | POST destination on the compromised site that receives the tunnel code and token. |
MITRE ATT&CK
T1027 · Obfuscated Files or InformationThe JSE file contains multiple Base64-encoded blobs.T1041 · Exfiltration Over C2 ChannelThe article reports that the tunnel’s interactive access enables the attacker to retrieve payloads and exfiltrate data.T1059 · Command and Scripting InterpreterThe JSE script is executed by Windows Script Host and launches a command through cmd.exe.T1090 · ProxyThe attacker uses a VS Code tunnel, which communicates through Microsoft’s tunnel service, for remote access.T1105 · Ingress Tool TransferThe script downloads VS Code CLI ZIP archives and code.exe.T1204.002 · Malicious FileThe campaign uses a document disguised as an HWPX file for the target to open.T1218 · System Binary Proxy ExecutionThe script launches the legitimate code.exe executable to establish a VS Code tunnel.T1566.001 · Spearphishing AttachmentThe JSE attachment was likely delivered to targets through spear-phishing email.
People
Vendors
Products
Hangul Word Processorin the first half of 2026”.The sample observed in this campaign is a JSE file disguised as a Hangul Word Processor (HWPX) document, likely sent to targets via a spear-phishing email.Visual Studio Codeleveraging Javascript Encoded (JSE) scripts and government-themed decoy documents to deploy a Visual Studio Code (VS Code) tunnel to establish remote access.Windows Script HostThe JSE file contains multiple Base64-encoded blobs and is executed by Windows Script Host.