# Kimsuky (Velvet Chollima) PebbleDash Cluster — HelloDoor, httpMalice, httpTroy/MemLoad & VS Code Remote Tunnel Abuse Against South Korea

> North Korea-linked Kimsuky (Velvet Chollima / APT43) expanded its PebbleDash-based toolset against South Korean government, defense, and medical targets, fielding the Rust HelloDoor backdoor, the ChaCha20-based httpMalice backdoor, and the httpTroy backdoor delivered by the MemLoad reflective loader, alongside the parallel AppleSeed/HappyDoor cluster. The operators abuse VS Code Remote Tunneling (GitHub device-code auth), DWAgent RAT, and Cloudflare/Ngrok tunnels for covert remote access, route C2 through free Korean hosting and compromised .kr websites, and ship malware whose code comments appear LLM-generated.

- **Published:** 2026-05-29T00:00:00Z
- **Last reviewed:** 2026-05-29T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0626
- **ID:** TL-2026-0626
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** Kimsuky (North Korea)
- **Detections:** 9 · **IOCs:** 63 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Kaspersky's Securelist (Sojun Ryu, 14 May 2026) disclosed an expanded cluster of PebbleDash-based tooling that overlaps in targeting, infrastructure, and stolen code-signing certificates with the long-running AppleSeed cluster, leading analysts to assess with medium-to-high confidence that a single Kimsuky-affiliated actor controls both. Kimsuky (also tracked as APT43, Velvet Chollima, Ruby Sleet, Black Banshee, Sparkling Pisces, Springtail, and Cerium) is a North Korean state-sponsored espionage group; this activity targets South Korean government, defense, military, medical, machinery, and energy organizations, with secondary defense-sector victims observed in Brazil and Germany. A notable hallmark across several samples is the presence of code comments that appear to have been generated by a large language model, indicating LLM-assisted malware development.

The PebbleDash cluster comprises three primary implants. HelloDoor is a Rust-based DLL backdoor first observed in August 2025 that communicates over HTTP through TryCloudflare quick tunnels (e.g. female-disorder-beta-metropolitan.trycloudflare.com), encrypts traffic with RC4 key "fwr3errsettwererfs", persists via HKCU Run values "tdll"/"install", and executes commands through "chcp 65001 > nul & cmd /U /C". httpMalice, the newest PebbleDash backdoor (December 2025 onward), ships in an HTTP variant (v1.9) and a Dropbox-API variant (v1.8), encrypts with ChaCha20 using pointer-derived randomized keys with an appended nonce, persists as the Windows service "CacheDB" (display name "Administrator") and HKCU Run values masquerading as "Everything 1.9a-[filesize]", and runs commands via "cmd.exe /c chcp 949". Its HTTP C2 hides inside compromised South Korean sites such as www.pyrotech.co.kr and newjo-imd.com. httpTroy is the primary long-term backdoor for access and exfiltration; it is delivered by the MemLoad reflective loader (V2/V3) which generates a system ID, drops flag files under C:\ProgramData, establishes scheduled-task persistence ("ChromeCheck" elevated / "EdgeCheck" non-elevated, each invoking regsvr32 every minute), and stores its payload in an NTFS Alternate Data Stream ([path]:HUI). MemLoad uses RC4 key "#RsfsetraW#@EsfesgsgAJOPj4eml;".

The parallel AppleSeed cluster remains active. AppleSeed (v2.1, descended from the 2019 v3.0) ships Dropper and Spy variants that collect documents, screenshots, keystrokes, and USB device lists, and — critically — exfiltrate the C:\GPKI directory containing South Korean government digital certificates (GPKI), enabling impersonation of government identities. HappyDoor is an AppleSeed-derived backdoor sharing its string-obfuscation algorithm, data-collection routines, and RSA encryption. Both clusters share a multi-stage dropper chain: JScript (.JSE) droppers, the Reger dropper (.SCR, e.g. security_20260126.scr) using XOR/RC4 with key "#RsfsetraW#@EsfesgsgAJOPj4eml;", and the Pidoc dropper (.PIF) using single-byte XOR (0xFF). Droppers execute follow-on payloads via regsvr32.exe /s and rundll32.exe.

For hands-on-keyboard access the operators lean heavily on legitimate remote-access software. They install Microsoft VS Code CLI (v1.106.2, fetched from the official Microsoft download CDN) via a Go-based installer ("vscode_payload", e.g. xipbkmaw.exe), run "code tunnel" with tunnel name "bizeugene", authenticate to GitHub through the device-code flow, capture the resulting login URL and device code to out.txt, and reach victims through https://vscode.dev/tunnel — blending C2 into trusted Microsoft and GitHub infrastructure. The installer reports tunnel URLs and heartbeats ("+++ I am started +++", "~~~ I am alive ~~~") to a Slack webhook and exfiltrates the tunnel link through a compromised site (www.yespp.co.kr). They also deploy the DWAgent RAT (relays node896147/node828765/node484265.dwservice.net, API key "kDRNGmWGTMpjQmREgQzU", installed from C:\programdata\dwagent\native\ via dwagsvc.exe installService/startService) and use Cloudflare Quick Tunnels and Ngrok as additional covert channels.

C2 infrastructure is built primarily on free Korean dynamic-DNS hosting registered through 내도메인.한국 (domains under .p-e.kr, .o-r.kr, .n-e.kr, .r-e.kr, .kro.kr), supplemented by compromised legitimate South Korean websites used as relays, InterServer VPS, and the Dropbox API for victim tracking. The combination of trusted-service abuse (VS Code/GitHub, Cloudflare, Dropbox, DWService), Korean-language living-off-the-land tradecraft, and certificate theft makes this a high-impact espionage campaign requiring behavioral detection and trusted-service egress monitoring rather than signature-only defenses.

## MITRE ATT&CK

- T1566.001 Spearphishing Attachment
- T1059.003 Windows Command Shell
- T1059.007 JavaScript
- T1053.005 Scheduled Task
- T1547.001 Registry Run Keys / Startup Folder
- T1543.003 Windows Service
- T1218.010 Regsvr32
- T1218.011 Rundll32
- T1620 Reflective Code Loading
- T1564.004 NTFS File Attributes
- T1027.013 Encrypted/Encoded File
- T1056.001 Keylogging
- T1649 Steal or Forge Authentication Certificates
- T1082 System Information Discovery
- T1120 Peripheral Device Discovery
- T1005 Data from Local System
- T1113 Screen Capture
- T1071.001 Web Protocols
- T1573.001 Symmetric Cryptography
- T1573.002 Asymmetric Cryptography
- T1102 Web Service
- T1219 Remote Access Tools
- T1105 Ingress Tool Transfer
- T1090 Proxy
- T1041 Exfiltration Over C2 Channel
- T1567.002 Exfiltration to Cloud Storage

## Sources

- [Disclosing new PebbleDash-based tools by Kimsuky (Securelist, Sojun Ryu)](https://securelist.com/kimsuky-appleseed-pebbledash-campaigns/119785/)
- [DPRK Actors Deploy VS Code Tunnels for Remote Hacking (Dark Reading)](https://www.darkreading.com/endpoint-security/dprk-vs-code-tunnels-remote-hacking)
- [MITRE ATT&CK — Kimsuky (G0094)](https://attack.mitre.org/groups/G0094/)
- [MITRE ATT&CK — PebbleDash (S0501)](https://attack.mitre.org/software/S0501/)
- [MITRE ATT&CK — AppleSeed (S0622)](https://attack.mitre.org/software/S0622/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0626