Kimsuky (Velvet Chollima) PebbleDash Cluster — HelloDoor, httpMalice, httpTroy/MemLoad & VS Code Remote Tunnel Abuse Against South Korea
Kimsuky (Velvet Chollima) PebbleDash Cluster (TL-2026-0626), also tracked as PebbleDash cluster, is a high-severity malware campaign, first published 2026-05-29. It is attributed to Kimsuky (North Korea) with medium confidence, affects Microsoft Windows (endpoints/servers), maps to 26 MITRE ATT&CK techniques (T1005, T1027.013, T1041), and is covered by 9 detection rules and 63 indicators of compromise.
Key facts for TL-2026-0626
- Threat ID
- TL-2026-0626
- Also known as
- PebbleDash cluster, AppleSeed cluster
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- 2026-05-29
- Last reviewed
- 2026-05-29
- Attribution
- Kimsuky
- Attribution confidence
- MEDIUM
- Nation-state nexus
- North Korea
- Motivation
- ESPIONAGE
- Target sectors
- government, defense, military, medical, machinery, energy
- Target regions
- South Korea, Brazil, Germany
- Detection rules
- 9
- Indicators of compromise
- 63
Malware and tooling in Kimsuky (Velvet Chollima) PebbleDash Cluster
Malware and tooling: AppleSeed - S0622, HappyDoor, HelloDoor, MemLoad, PEBBLEDASH, httpMalice, http_troy, DWAgent, VS Code Remote Tunneling
North Korea-linked Kimsuky (Velvet Chollima / APT43) expanded its PebbleDash-based toolset against South Korean government, defense, and medical targets, fielding the Rust HelloDoor backdoor, the ChaCha20-based httpMalice backdoor, and the httpTroy backdoor delivered by the MemLoad reflective loader, alongside the parallel AppleSeed/HappyDoor cluster. The operators abuse VS Code Remote Tunneling (GitHub device-code auth), DWAgent RAT, and Cloudflare/Ngrok tunnels for covert remote access, route C2 through free Korean hosting and compromised .kr websites, and ship malware whose code comments appear LLM-generated.
How Kimsuky (Velvet Chollima) PebbleDash Cluster works
Kaspersky's Securelist (Sojun Ryu, 14 May 2026) disclosed an expanded cluster of PebbleDash-based tooling that overlaps in targeting, infrastructure, and stolen code-signing certificates with the long-running AppleSeed cluster, leading analysts to assess with medium-to-high confidence that a single Kimsuky-affiliated actor controls both. Kimsuky (also tracked as APT43, Velvet Chollima, Ruby Sleet, Black Banshee, Sparkling Pisces, Springtail, and Cerium) is a North Korean state-sponsored espionage group; this activity targets South Korean government, defense, military, medical, machinery, and energy organizations, with secondary defense-sector victims observed in Brazil and Germany. A notable hallmark across several samples is the presence of code comments that appear to have been generated by a large language model, indicating LLM-assisted malware development.
The PebbleDash cluster comprises three primary implants. HelloDoor is a Rust-based DLL backdoor first observed in August 2025 that communicates over HTTP through TryCloudflare quick tunnels (e.g. female-disorder-beta-metropolitan.trycloudflare.com), encrypts traffic with RC4 key "fwr3errsettwererfs", persists via HKCU Run values "tdll"/"install", and executes commands through "chcp 65001 > nul & cmd /U /C". httpMalice, the newest PebbleDash backdoor (December 2025 onward), ships in an HTTP variant (v1.9) and a Dropbox-API variant (v1.8), encrypts with ChaCha20 using pointer-derived randomized keys with an appended nonce, persists as the Windows service "CacheDB" (display name "Administrator") and HKCU Run values masquerading as "Everything 1.9a-[filesize]", and runs commands via "cmd.exe /c chcp 949". Its HTTP C2 hides inside compromised South Korean sites such as www.pyrotech.co.kr and newjo-imd.com. httpTroy is the primary long-term backdoor for access and exfiltration; it is delivered by the MemLoad reflective loader (V2/V3) which generates a system ID, drops flag files under C:\ProgramData, establishes scheduled-task persistence ("ChromeCheck" elevated / "EdgeCheck" non-elevated, each invoking regsvr32 every minute), and stores its payload in an NTFS Alternate Data Stream ([path]:HUI). MemLoad uses RC4 key "#RsfsetraW#@EsfesgsgAJOPj4eml;".
The parallel AppleSeed cluster remains active. AppleSeed (v2.1, descended from the 2019 v3.0) ships Dropper and Spy variants that collect documents, screenshots, keystrokes, and USB device lists, and — critically — exfiltrate the C:\GPKI directory containing South Korean government digital certificates (GPKI), enabling impersonation of government identities. HappyDoor is an AppleSeed-derived backdoor sharing its string-obfuscation algorithm, data-collection routines, and RSA encryption. Both clusters share a multi-stage dropper chain: JScript (.JSE) droppers, the Reger dropper (.SCR, e.g. security_20260126.scr) using XOR/RC4 with key "#RsfsetraW#@EsfesgsgAJOPj4eml;", and the Pidoc dropper (.PIF) using single-byte XOR (0xFF). Droppers execute follow-on payloads via regsvr32.exe /s and rundll32.exe.
For hands-on-keyboard access the operators lean heavily on legitimate remote-access software. They install Microsoft VS Code CLI (v1.106.2, fetched from the official Microsoft download CDN) via a Go-based installer ("vscode_payload", e.g. xipbkmaw.exe), run "code tunnel" with tunnel name "bizeugene", authenticate to GitHub through the device-code flow, capture the resulting login URL and device code to out.txt, and reach victims through https://vscode.dev/tunnel — blending C2 into trusted Microsoft and GitHub infrastructure. The installer reports tunnel URLs and heartbeats ("+++ I am started +++", "~~~ I am alive ~~~") to a Slack webhook and exfiltrates the tunnel link through a compromised site (www.yespp.co.kr). They also deploy the DWAgent RAT (relays node896147/node828765/node484265.dwservice.net, API key "kDRNGmWGTMpjQmREgQzU", installed from C:\programdata\dwagent ative\ via dwagsvc.exe installService/startService) and use Cloudflare Quick Tunnels and Ngrok as additional covert channels.
C2 infrastructure is built primarily on free Korean dynamic-DNS hosting registered through 내도메인.한국 (domains under .p-e.kr, .o-r.kr, .n-e.kr, .r-e.kr, .kro.kr), supplemented by compromised legitimate South Korean websites used as relays, InterServer VPS, and the Dropbox API for victim tracking. The combination of trusted-service abuse (VS Code/GitHub, Cloudflare, Dropbox, DWService), Korean-language living-off-the-land tradecraft, and certificate theft makes this a high-impact espionage campaign requiring behavioral detection and trusted-service egress monitoring rather than signature-only defenses.
MITRE ATT&CK techniques used in TL-2026-0626
Collection
T1005 Data from Local System; T1113 Screen Capture
Defense Evasion
T1027.013 Encrypted/Encoded File; T1218.010 Regsvr32; T1218.011 Rundll32; T1564.004 NTFS File Attributes; T1620 Reflective Code Loading
Exfiltration
T1041 Exfiltration Over C2 Channel; T1567.002 Exfiltration to Cloud Storage
Execution
T1053.005 Scheduled Task; T1059.003 Windows Command Shell; T1059.007 JavaScript
Credential Access
T1056.001 Keylogging; T1649 Steal or Forge Authentication Certificates
Command and Control
T1071.001 Web Protocols; T1090 Proxy; T1102 Web Service; T1105 Ingress Tool Transfer; T1219 Remote Access Tools; T1573.001 Symmetric Cryptography; T1573.002 Asymmetric Cryptography
Discovery
T1082 System Information Discovery; T1120 Peripheral Device Discovery
Persistence
T1543.003 Windows Service; T1547.001 Registry Run Keys / Startup Folder
Initial Access
Affected products and versions in Kimsuky (Velvet Chollima) PebbleDash Cluster
- Microsoft — Windows (endpoints/servers)
Vulnerable versions: Windows 10; Windows 11; Windows Server - Microsoft — Visual Studio Code Remote Tunnels (abused legitimate software)
Vulnerable versions: VS Code CLI 1.106.2 (abused for covert access) - DWService — DWAgent (abused legitimate RAT)
Vulnerable versions: DWAgent (relay-based remote access) - Cloudflare — Cloudflare Quick Tunnels / TryCloudflare (abused service)
Vulnerable versions: trycloudflare quick tunnels
Remediation for Kimsuky (Velvet Chollima) PebbleDash Cluster
Patches
- No vendor patch applies — this is malware/TTP activity, not a single CVE
- Keep Windows, Microsoft VS Code, and all endpoint software fully patched to reduce the dropper/loader's footholds
- Rotate and re-issue any GPKI certificates and credentials exposed on compromised hosts
Immediate actions
- Block and alert on all listed C2 domains and the trycloudflare/ngrok/dwservice infrastructure at the perimeter and DNS layer
- Hunt for the Windows service 'CacheDB' (display name 'Administrator') and scheduled tasks 'ChromeCheck' / 'EdgeCheck' invoking regsvr32 every minute
- Alert on 'code tunnel' execution and GitHub device-code authentication originating from servers/non-developer endpoints
- Detect DWAgent installation (dwagsvc.exe installService/startService, C:\programdata\dwagent\native\) and the DWAgent API key kDRNGmWGTMpjQmREgQzU
- Search for NTFS Alternate Data Streams named ':HUI' and flag files matching C:\ProgramData\[7chars].[4chars]
- Audit access to C:\GPKI and revoke/reissue any potentially compromised GPKI government certificates
Workarounds
- Disable or tightly gate VS Code Remote Tunneling and GitHub device-code auth via policy where not required
- Block consumer tunneling services and DWService relays via egress filtering
- Disable Windows Script Host (.JSE) execution and block .SCR/.PIF execution from user-writable paths
Longer-term hardening
- Deploy EDR with behavioral detection for regsvr32/rundll32 proxy execution, reflective DLL loading, and HKCU Run-key persistence
- Restrict and monitor outbound access to consumer tunneling/remote-access services (Cloudflare Quick Tunnels, Ngrok, DWService, vscode.dev tunnels)
- Implement application allow-listing and developer-tooling controls so VS Code Remote Tunneling cannot be invoked on production/non-developer hosts
- Network-segment government, defense, and medical environments and constrain Dropbox/Slack/GitHub egress to sanctioned accounts
- Establish continuous threat hunting for Korean free-hosting C2 (.p-e.kr/.o-r.kr/.n-e.kr/.r-e.kr/.kro.kr) and compromised-site relay patterns
Timeline of Kimsuky (Velvet Chollima) PebbleDash Cluster
- AppleSeed backdoor (version 3.0) first appears in Kimsuky operations against South Korean targets.
- PebbleDash backdoor family publicly linked to Kimsuky operations.
- AppleSeed updated with a new dropper chain and the capability to collect C:\GPKI South Korean government digital certificates.
- MemLoad reflective loader V2/V3 deployed, delivering the httpTroy backdoor via scheduled-task persistence.
- HelloDoor, a Rust-based DLL backdoor using TryCloudflare HTTP tunneling, first identified.
- Operators observed abusing VS Code Remote Tunneling with GitHub device-code authentication and Slack-webhook beaconing for covert remote access.
- DWAgent RAT deployed via DWService relays for hands-on-keyboard remote control of compromised hosts.
- httpMalice backdoor emerges in HTTP (v1.9) and Dropbox (v1.8) variants using ChaCha20 encryption and a 'CacheDB' Windows service for persistence.
- Reger dropper deployed as security_20260126.scr, using XOR/RC4 to stage follow-on PebbleDash payloads.
- Kaspersky Securelist publishes 'Disclosing new PebbleDash-based tools by Kimsuky', detailing the expanded cluster and IOCs.
- As of 2026-05-29, this Kimsuky (APT43) PebbleDash cluster remains an active North Korean espionage threat: Kaspersky's 14 May 2026 report plus Hacker News/Dark Reading coverage confirm ongoing Mar-Apr 2026 attacks on South Korea using HelloDoor/httpMalice/httpTroy and VS Code tunnel abuse. No takedown, arrest, or sinkhole exists; being malware/TTP-based with no CVE, defense is behavioral, and the actor and tooling stay fully operational.
Sources cited for Kimsuky (Velvet Chollima) PebbleDash Cluster
Threats related to Kimsuky (Velvet Chollima) PebbleDash Cluster
Detection coverage for TL-2026-0626
As of 2026-05-29, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0626 across Splunk SPL, Microsoft KQL and Sigma, covering 63 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.