Loading malware…
PebbleDash is a Windows backdoor associated with North Korean cyber operations and most prominently linked to Kimsuky, while earlier public reporting also tied it to Lazarus and HIDDEN COBRA activity. It has been used in espionage-oriented intrusions against South Korean and other targets, including diplomacy-, defense-, government-, education-, and enterprise-related victims. The malware has appeared both as a standalone beaconing implant and as part of broader intrusion chains involving additional tooling such as proxy malware, keyloggers, RDP-enablement utilities, and other Kimsuky malware families.
PebbleDash provides remote control over compromised hosts through command-and-control communications that support system enumeration, process management, command execution, and file operations including upload, download, deletion, and execution. Reported variants can enable Windows command-line access, create and terminate processes, list directories, modify configuration, and self-delete. Some samples use obfuscated imports and custom string decoding, and at least one well-documented variant disguises network traffic with a FakeTLS handshake before switching to RC4-encrypted command traffic.
Operationally, PebbleDash has been delivered through spearphishing campaigns using compressed attachments, malicious shortcut files, and droppers in script and executable formats. Kimsuky campaigns have used LNK-based infection chains with diplomatic or business-themed decoys to install PebbleDash alongside supporting tools for persistence, privilege escalation, proxying, keylogging, and RDP access. Additional observed delivery chains have relied on PIF, JSE, SCR, and EXE droppers. Some variants require specific command-line arguments to install or activate, copy themselves into masqueraded locations, store configuration data in the Windows registry, or inject into other processes.
The malware is best characterized as a backdoor used for sustained access and follow-on exploitation in targeted intrusions. Its recurring use across multiple campaigns, overlap with other DPRK malware ecosystems, and appearance in both Lazarus- and Kimsuky-linked operations make it notable both as an operational implant and as an example of tooling reuse or transfer across North Korean threat clusters.
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each card links to the full Mallory page for that vulnerability.
2 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
The reports outline three different malware types: PebbleDash Trojan, TaintedScribe Trojan and CopperHedge RAT.
Malware used by the Kimsuky group not only include custom-made such as AppleSeed and PebbleDash, but also open-source or commercial malware such as XRat, HVNC, Amadey, and Metasploit Meterpreter.
29 distinct techniques documented for this family, organized by ATT&CK tactic.
More than 400 shorten URLs for phishing
The attacker sent the following spear phishing email, prompting the user to download and run the compressed file after clicking the link for the attachment.
Shorten URLs ... Original URLs ... More than 400 shorten URLs for phishing
“%APPDATA%\Microsoft\Windows\Templates\Templates.js”와 ... “Templates.ps1”를 생성하고 “Windows Templates Update”라는 이름의 작업에 등록한다.
The two Trojans, PebbleDash and TaintedScribe are beaconing implants that can be used to exfiltrate information, download additional malicious content and execute commands on infected devices. CopperHedge is a variant of the Manuscrypt RAT and is a remote access tool that can be used to run arbitrary commands...
“vvn. 31.pdf...lnk”가 실행되면 다음 명령을 통해 파워쉘 스크립트를 실행한다.
It has the capability to download, upload, delete, and execute files; enable Windows CLI access; create and terminate processes; and perform target system enumeration.
Javascript to deliver malware
prompting the user to download and run the compressed file after clicking the link for the attachment.
문서 파일을 위장하여 유포되기 때문에 사용자는 문서 파일로 생각해 첨부 파일을 다운로드해 실행할 수 있으며
“%APPDATA%\Microsoft\Windows\Templates\Templates.js”와 ... “Templates.ps1”를 생성하고 “Windows Templates Update”라는 이름의 작업에 등록한다.
내부에 존재하는 설정 파일을 복호화 및 압축 해제하여 레지스트리 키에 쓰고 ... 설정 정보가 저장된 레지스트리 키 : HKLM\SYSTEM\CurrentControlSet\Control\WMI\Security
#Kimsuky, #Phishing, #PebbleDash, #LNK, #PrxClient
“%APPDATA%\Microsoft\Windows\Templates\Templates.js”와 ... “Templates.ps1”를 생성하고 “Windows Templates Update”라는 이름의 작업에 등록한다.
인젝터는 LSASS 프로세스에 PebbleDash를 인젝션하며
#Kimsuky, #Phishing, #PebbleDash, #LNK, #PrxClient
The sample obfuscates strings used for API lookups using a custom XOR algorithm.
The sample performs dynamic dynamic link library (DLL) importing and application programming interface (API) lookups using LoadLibrary and GetProcAddress on obfuscated strings in an attempt to hide it’s usage of network functions.
The dropper drops PebbleDash in the “C:\ProgramData\thumbs.db.pif” path and runs it. At the same time, it also drops and runs the “C:\ProgramData\construction completion notice.pdf” file to trick the user into thinking that a normal PDF document file has been opened.
인젝터는 LSASS 프로세스에 PebbleDash를 인젝션하며
It has the capability to download, upload, delete, and execute files...
공격에 사용된 LNK 악성코드가 실행되면 자기 자신을 인자로 Mshta를 실행한다. 실제 내부에는 HTA 포맷의 악성 스크립트가 존재하기 때문에 Mshta를 통해 악성 루틴이 실행된다.
내부에 존재하는 설정 파일을 복호화 및 압축 해제하여 레지스트리 키에 쓰고 ... 설정 정보가 저장된 레지스트리 키 : HKLM\SYSTEM\CurrentControlSet\Control\WMI\Security
The attacker can use backdoor to install another remote control malware such as Meterpreter and HVNC, or various other types of malware for privilege escalation and account credential theft.
It has the capability to download, upload, delete, and execute files; enable Windows CLI access; create and terminate processes; and perform target system enumeration.
It has the capability to download, upload, delete, and execute files; enable Windows CLI access; create and terminate processes; and perform target system enumeration.
Once the FakeTLS handshake is complete, all further packets use a FakeTLS header, followed by RC4 encrypted data.
The sample and the command and control (C2) externally appear to perform a standard TLS authentication, however, most of the fields used are filled with random data from rand().
FBI has high confidence that HIDDEN COBRA actors are using malware variants in conjunction with proxy servers to maintain a presence on victim networks and to further network exploitation. | The sample utilizes a “FakeTLS” scheme in an attempt to obfuscate its network communications.
FBI has high confidence that HIDDEN COBRA actors are using malware variants in conjunction with proxy servers to maintain a presence on victim networks and to further network exploitation.
Through communication with a Dropbox and TCP socket-based C&C server, the group installs multiple malware and tools including PEBBLEDASH.
The two Trojans, PebbleDash and TaintedScribe are beaconing implants that can be used to exfiltrate information, download additional malicious content...
Once the FakeTLS handshake is complete, all further packets use a FakeTLS header, followed by RC4 encrypted data.
The two Trojans, PebbleDash and TaintedScribe are beaconing implants that can be used to exfiltrate information... CopperHedge is a variant of the Manuscrypt RAT ... and exfiltrate data.
39 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
26 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.