Threat reportMalwareTL-2026-0626
Kimsuky (Velvet Chollima) PebbleDash Cluster — HelloDoor, httpMalice, httpTroy/MemLoad & VS Code Remote Tunnel Abuse Against South Korea
Kimsuky (Velvet Chollima) PebbleDash Cluster (TL-2026-0626), also tracked as PebbleDash cluster, is a high-severity malware campaign, first published 2026-05-29. It is attributed to Kimsuky (North Korea) with medium confidence, affects Microsoft Windows (endpoints/servers), maps to 26 MITRE ATT&CK techniques (T1005, T1027.013, T1041), and is covered by 9 detection rules and 63 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 26MITRE ATT&CK
- Actors
- 1Kimsuky
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 63Indicators of compromise
Key facts for TL-2026-0626
- Threat ID
- TL-2026-0626
- Also known as
- PebbleDash cluster, AppleSeed cluster
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- Last reviewed
- Attribution
- Kimsuky
- Attribution confidence
- MEDIUM
- Nation-state nexus
- North Korea
- Motivation
- ESPIONAGE
- Target sectors
- government, defense, military, medical, machinery, energy
- Target regions
- South Korea, Brazil, Germany
- Detection rules
- 9
- Indicators of compromise
- 63
Malware and tooling in Kimsuky (Velvet Chollima) PebbleDash Cluster
Malware and tooling: AppleSeed - S0622, HappyDoor, HelloDoor, MemLoad, PEBBLEDASH, httpMalice, http_troy, DWAgent, VS Code Remote Tunneling
How Kimsuky (Velvet Chollima) PebbleDash Cluster works
North Korea-linked Kimsuky (Velvet Chollima / APT43) expanded its PebbleDash-based toolset against South Korean government, defense, and medical targets, fielding the Rust HelloDoor backdoor, the ChaCha20-based httpMalice backdoor, and the httpTroy backdoor delivered by the MemLoad reflective loader, alongside the parallel AppleSeed/HappyDoor cluster. The operators abuse VS Code Remote Tunneling (GitHub device-code auth), DWAgent RAT, and Cloudflare/Ngrok tunnels for covert remote access, route C2 through free Korean hosting and compromised .kr websites, and ship malware whose code comments appear LLM-generated.
Kaspersky's Securelist (Sojun Ryu, 14 May 2026) disclosed an expanded cluster of PebbleDash-based tooling that overlaps in targeting, infrastructure, and stolen code-signing certificates with the long-running AppleSeed cluster, leading analysts to assess with medium-to-high confidence that a single Kimsuky-affiliated actor controls both. Kimsuky (also tracked as APT43, Velvet Chollima, Ruby Sleet, Black Banshee, Sparkling Pisces, Springtail, and Cerium) is a North Korean state-sponsored espionage group; this activity targets South Korean government, defense, military, medical, machinery, and energy organizations, with secondary defense-sector victims observed in Brazil and Germany. A notable hallmark across several samples is the presence of code comments that appear to have been generated by a large language model, indicating LLM-assisted malware development.
The PebbleDash cluster comprises three primary implants. HelloDoor is a Rust-based DLL backdoor first observed in August 2025 that communicates over HTTP through TryCloudflare quick tunnels (e.g. female-disorder-beta-metropolitan.trycloudflare.com), encrypts traffic with RC4 key "fwr3errsettwererfs", persists via HKCU Run values "tdll"/"install", and executes commands through "chcp 65001 > nul & cmd /U /C". httpMalice, the newest PebbleDash backdoor (December 2025 onward), ships in an HTTP variant (v1.9) and a Dropbox-API variant (v1.8), encrypts with ChaCha20 using pointer-derived randomized keys with an appended nonce, persists as the Windows service "CacheDB" (display name "Administrator") and HKCU Run values masquerading as "Everything 1.9a-[filesize]", and runs commands via "cmd.exe /c chcp 949". Its HTTP C2 hides inside compromised South Korean sites such as www.pyrotech.co.kr and newjo-imd.com. httpTroy is the primary long-term backdoor for access and exfiltration; it is delivered by the MemLoad reflective loader (V2/V3) which generates a system ID, drops flag files under C:\ProgramData, establishes scheduled-task persistence ("ChromeCheck" elevated / "EdgeCheck" non-elevated, each invoking regsvr32 every minute), and stores its payload in an NTFS Alternate Data Stream ([path]:HUI). MemLoad uses RC4 key "#RsfsetraW#@EsfesgsgAJOPj4eml;".
The parallel AppleSeed cluster remains active. AppleSeed (v2.1, descended from the 2019 v3.0) ships Dropper and Spy variants that collect documents, screenshots, keystrokes, and USB device lists, and — critically — exfiltrate the C:\GPKI directory containing South Korean government digital certificates (GPKI), enabling impersonation of government identities. HappyDoor is an AppleSeed-derived backdoor sharing its string-obfuscation algorithm, data-collection routines, and RSA encryption. Both clusters share a multi-stage dropper chain: JScript (.JSE) droppers, the Reger dropper (.SCR, e.g. security_20260126.scr) using XOR/RC4 with key "#RsfsetraW#@EsfesgsgAJOPj4eml;", and the Pidoc dropper (.PIF) using single-byte XOR (0xFF). Droppers execute follow-on payloads via regsvr32.exe /s and rundll32.exe.
For hands-on-keyboard access the operators lean heavily on legitimate remote-access software. They install Microsoft VS Code CLI (v1.106.2, fetched from the official Microsoft download CDN) via a Go-based installer ("vscode_payload", e.g. xipbkmaw.exe), run "code tunnel" with tunnel name "bizeugene", authenticate to GitHub through the device-code flow, capture the resulting login URL and device code to out.txt, and reach victims through https://vscode.dev/tunnel — blending C2 into trusted Microsoft and GitHub infrastructure. The installer reports tunnel URLs and heartbeats ("+++ I am started +++", "~~~ I am alive ~~~") to a Slack webhook and exfiltrates the tunnel link through a compromised site (www.yespp.co.kr). They also deploy the DWAgent RAT (relays node896147/node828765/node484265.dwservice.net, API key "kDRNGmWGTMpjQmREgQzU", installed from C:\programdata\dwagent\native\ via dwagsvc.exe installService/startService) and use Cloudflare Quick Tunnels and Ngrok as additional covert channels.
C2 infrastructure is built primarily on free Korean dynamic-DNS hosting registered through 내도메인.한국 (domains under .p-e.kr, .o-r.kr, .n-e.kr, .r-e.kr, .kro.kr), supplemented by compromised legitimate South Korean websites used as relays, InterServer VPS, and the Dropbox API for victim tracking. The combination of trusted-service abuse (VS Code/GitHub, Cloudflare, Dropbox, DWService), Korean-language living-off-the-land tradecraft, and certificate theft makes this a high-impact espionage campaign requiring behavioral detection and trusted-service egress monitoring rather than signature-only defenses.
MITRE ATT&CK techniques used in TL-2026-0626
Collection
T1005 Data from Local System; T1113 Screen Capture
Defense Evasion
T1027.013 Encrypted/Encoded File; T1218.010 Regsvr32; T1218.011 Rundll32; T1564.004 NTFS File Attributes; T1620 Reflective Code Loading
Exfiltration
T1041 Exfiltration Over C2 Channel; T1567.002 Exfiltration to Cloud Storage
Execution
T1053.005 Scheduled Task; T1059.003 Windows Command Shell; T1059.007 JavaScript
Credential Access
T1056.001 Keylogging; T1649 Steal or Forge Authentication Certificates
Command and Control
T1071.001 Web Protocols; T1090 Proxy; T1102 Web Service; T1105 Ingress Tool Transfer; T1219 Remote Access Tools; T1573.001 Symmetric Cryptography; T1573.002 Asymmetric Cryptography
Discovery
T1082 System Information Discovery; T1120 Peripheral Device Discovery
Persistence
T1543.003 Windows Service; T1547.001 Registry Run Keys / Startup Folder
Initial Access
Affected products and versions in Kimsuky (Velvet Chollima) PebbleDash Cluster
- Microsoft — Windows (endpoints/servers)
Vulnerable versions: Windows 10; Windows 11; Windows Server - Microsoft — Visual Studio Code Remote Tunnels (abused legitimate software)
Vulnerable versions: VS Code CLI 1.106.2 (abused for covert access) - DWService — DWAgent (abused legitimate RAT)
Vulnerable versions: DWAgent (relay-based remote access) - Cloudflare — Cloudflare Quick Tunnels / TryCloudflare (abused service)
Vulnerable versions: trycloudflare quick tunnels
Remediation for Kimsuky (Velvet Chollima) PebbleDash Cluster
Patches
- No vendor patch applies — this is malware/TTP activity, not a single CVE
- Keep Windows, Microsoft VS Code, and all endpoint software fully patched to reduce the dropper/loader's footholds
- Rotate and re-issue any GPKI certificates and credentials exposed on compromised hosts
Immediate actions
- Block and alert on all listed C2 domains and the trycloudflare/ngrok/dwservice infrastructure at the perimeter and DNS layer
- Hunt for the Windows service 'CacheDB' (display name 'Administrator') and scheduled tasks 'ChromeCheck' / 'EdgeCheck' invoking regsvr32 every minute
- Alert on 'code tunnel' execution and GitHub device-code authentication originating from servers/non-developer endpoints
- Detect DWAgent installation (dwagsvc.exe installService/startService, C:\programdata\dwagent\native\) and the DWAgent API key kDRNGmWGTMpjQmREgQzU
- Search for NTFS Alternate Data Streams named ':HUI' and flag files matching C:\ProgramData\[7chars].[4chars]
- Audit access to C:\GPKI and revoke/reissue any potentially compromised GPKI government certificates
Workarounds
- Disable or tightly gate VS Code Remote Tunneling and GitHub device-code auth via policy where not required
- Block consumer tunneling services and DWService relays via egress filtering
- Disable Windows Script Host (.JSE) execution and block .SCR/.PIF execution from user-writable paths
Longer-term hardening
- Deploy EDR with behavioral detection for regsvr32/rundll32 proxy execution, reflective DLL loading, and HKCU Run-key persistence
- Restrict and monitor outbound access to consumer tunneling/remote-access services (Cloudflare Quick Tunnels, Ngrok, DWService, vscode.dev tunnels)
- Implement application allow-listing and developer-tooling controls so VS Code Remote Tunneling cannot be invoked on production/non-developer hosts
- Network-segment government, defense, and medical environments and constrain Dropbox/Slack/GitHub egress to sanctioned accounts
- Establish continuous threat hunting for Korean free-hosting C2 (.p-e.kr/.o-r.kr/.n-e.kr/.r-e.kr/.kro.kr) and compromised-site relay patterns
Timeline of Kimsuky (Velvet Chollima) PebbleDash Cluster
- AppleSeed backdoor (version 3.0) first appears in Kimsuky operations against South Korean targets.
- PebbleDash backdoor family publicly linked to Kimsuky operations.
- AppleSeed updated with a new dropper chain and the capability to collect C:\GPKI South Korean government digital certificates.
- MemLoad reflective loader V2/V3 deployed, delivering the httpTroy backdoor via scheduled-task persistence.
- HelloDoor, a Rust-based DLL backdoor using TryCloudflare HTTP tunneling, first identified.
- Operators observed abusing VS Code Remote Tunneling with GitHub device-code authentication and Slack-webhook beaconing for covert remote access.
- DWAgent RAT deployed via DWService relays for hands-on-keyboard remote control of compromised hosts.
- httpMalice backdoor emerges in HTTP (v1.9) and Dropbox (v1.8) variants using ChaCha20 encryption and a 'CacheDB' Windows service for persistence.
- Reger dropper deployed as security_20260126.scr, using XOR/RC4 to stage follow-on PebbleDash payloads.
- Kaspersky Securelist publishes 'Disclosing new PebbleDash-based tools by Kimsuky', detailing the expanded cluster and IOCs.
- As of 2026-05-29, this Kimsuky (APT43) PebbleDash cluster remains an active North Korean espionage threat: Kaspersky's 14 May 2026 report plus Hacker News/Dark Reading coverage confirm ongoing Mar-Apr 2026 attacks on South Korea using HelloDoor/httpMalice/httpTroy and VS Code tunnel abuse. No takedown, arrest, or sinkhole exists; being malware/TTP-based with no CVE, defense is behavioral, and the actor and tooling stay fully operational.
Sources cited for Kimsuky (Velvet Chollima) PebbleDash Cluster
Detection coverage for TL-2026-0626
As of 2026-05-29, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0626 across Splunk SPL, Microsoft KQL and Sigma, covering 63 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.