Loading story…
North Korea-aligned threat actor Kimsuky has expanded operations across its AppleSeed and PebbleDash intrusion clusters, using spear-phishing documents to gain initial access and then deploying a broader malware set that includes HelloDoor, httpMalice, MemLoad, httpTroy, AppleSeed, and HappyDoor. Researchers assess with medium-high confidence that both clusters are operated by Kimsuky-affiliated actors, also tracked as APT43 and Ruby Sleet, with AppleSeed showing a stronger focus on government organizations while PebbleDash activity has also reached defense-related entities in Brazil and Germany in addition to South Korean targets.
The campaigns show a notable shift in post-compromise tradecraft, with operators increasingly abusing legitimate remote administration and tunneling tools such as VSCode Remote Tunneling, DWAgent, and Cloudflare Quick Tunnels for persistence and access. The report also notes malware development changes including the use of Rust, probable LLM-assisted code comments, and continued reliance on infrastructure patterns tied to free South Korean hosting domains and compromised South Korean websites, indicating that Kimsuky is modernizing its tooling while preserving long-standing operational habits.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
8 events from the most recent confirmed update back to the earliest known activity.
ENKI attributed a March-April 2026 campaign targeting South Korean military and corporate entities to Kimsuky. The operation used fake South Korean security software installers and a counterfeit Cisco Webex page to deliver the HTTPSpy RAT, with staged loaders, scheduled-task persistence, selective payload delivery, and a JSONP-based infection check dubbed JSONPing.
In the first half of 2025, Kimsuky conducted four spear-phishing campaigns targeting corporate recruiters, cryptocurrency investors and developers, defense-sector officials, and graduate school administrators. The campaigns used LNK files disguised as PDFs and a double-extension .hwpx.jse lure to deploy malware, establish persistence, and communicate via services such as GitHub raw APIs, Microsoft CDN, and VSCode tunnels.
AhnLab ASEC reported that Kimsuky targeted South Korean research institutes using phishing emails themed as fake import declarations. The campaign represents a distinct victim focus and social-engineering lure within Kimsuky’s ongoing intrusion activity.
S2W assessed that Kimsuky's SeedpuNK subgroup had been using Go-based malware related to AppleSeed since at least March 2023. The activity included tools such as AlphaSeed, Troll Stealer, and GoBear, marking a shift from earlier C/C++ tooling toward cross-platform Go malware with capabilities including data theft, backdoor access, and SOCKS proxy support.
ASEC reported that in May 2023 Kimsuky expanded its malware delivery activity by using CHM help files instead of typical document lures, with themes including cryptocurrency, tax filings, contracts, invoices, and gaming account notices. The campaign established persistence, exfiltrated host data to a remote PHP endpoint, and selectively delivered follow-on CAB-based malware, with ASEC publishing hashes and network indicators.
Securelist published research assessing with medium-high confidence that both the PebbleDash and AppleSeed clusters are controlled by Kimsuky-affiliated operators. The report maps the activity to aliases including APT43 and Ruby Sleet.
Researchers observed Kimsuky expanding its toolset beyond malware such as HelloDoor, httpMalice, MemLoad, httpTroy, AppleSeed, and HappyDoor to greater abuse of legitimate remote-access and persistence tools including VSCode Remote Tunneling and DWAgent. The report also notes tactical changes such as use of Rust, Cloudflare Quick Tunnels, GitHub-authenticated VSCode tunnels, and probable LLM-assisted code comments while retaining infrastructure patterns tied to free South Korean hosting domains and compromised South Korean websites.
Kimsuky-affiliated operators ran intrusion activity across the AppleSeed and PebbleDash clusters, primarily using spear-phishing attachments disguised as documents for initial access. The campaigns targeted South Korean public and private organizations, with PebbleDash activity also affecting defense-related entities in Brazil and Germany and AppleSeed showing a stronger focus on government organizations.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
14 references tracked. Mallory keeps watching after this page renders.
enki.co.kr
Open sourcegist.github.com
Open sourceidanmalihi.com
Open sourcescworld.com
Open sourceasec.ahnlab.com
Open sourceasec.ahnlab.com
Open sourcesecurelist.com
Open sourcevirusbulletin.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
North Korean-linked **Kimsuky** has been linked to an ongoing spear-phishing campaign that impersonates diplomatic personnel and targets people involved in diplomacy and the education sector. According to AhnLab, the attackers used decoy diplomatic documents and malicious **`.lnk`** files to launch embedded **HTA** or **PowerShell** scripts, leading to the deployment of multiple payloads including the **PebbleDash** backdoor and **PrxClient** proxy malware. Additional tooling reportedly included downloaders, keyloggers, **RDP Wrapper**, RDP patching utilities, and UAC bypass tools such as **UACMe** and **SspiUacBypass**. The intrusions were designed to establish durable remote access and steal information from compromised Windows systems. AhnLab said the attackers created persistence through scheduled tasks, enabled or created backdoor accounts, modified RDP behavior to allow multi-session remote access, and in one PebbleDash variant stored configuration data in the registry before injecting into **LSASS**. The campaign also used scripts to collect local files and system information, capture keystrokes, and exfiltrate stolen data to command-and-control servers.
Jul 23, 2026
The North Korean threat actor Kimsuky has been identified distributing a new backdoor, codenamed **HttpTroy**, in a targeted spear-phishing campaign against a South Korean victim. The attack leveraged a phishing email containing a ZIP file disguised as a VPN invoice, which, when opened, initiated a multi-stage infection chain involving a dropper, a loader (`MemLoad`), and the final **HttpTroy** backdoor. The malware is capable of file transfer, screenshot capture, command execution with elevated privileges, in-memory loading of executables, reverse shell access, process termination, and trace removal. Persistence is established via a scheduled task impersonating the South Korean cybersecurity company AhnLab, and communication with the command-and-control server is conducted over HTTP POST requests. **HttpTroy** employs advanced obfuscation techniques, including custom API hashing and string obfuscation using XOR and SIMD instructions, to evade detection and analysis. The campaign highlights the continued evolution of North Korean APT toolsets, with Kimsuky adopting stealthier malware to enhance their cyber-espionage capabilities. Security researchers have emphasized the sophistication of the infection chain and the backdoor's ability to provide attackers with full control over compromised systems.
Jun 29, 2026
North Korean state-backed threat group **Kimsuky** has been linked to an ongoing spear-phishing campaign targeting organizations and individuals in the United States, Europe, and Asia, including think tanks, research universities, government entities, and staff at Korea Risk Group. Researchers said the operation uses tailored phishing emails and **OneDrive-hosted password-protected documents** containing malicious Microsoft Office macros to gain initial access. The campaign delivers a new reconnaissance malware component dubbed **ReconShark**, assessed as an evolved variant of BabyShark. ReconShark gathers host data including running processes, battery status, and installed security products, then exfiltrates the information via HTTP `POST` requests without first writing it to disk. Based on the victim environment, the malware can also deploy follow-on payloads such as VBS, HTA, batch scripts, DLLs, malicious Office templates, and modified LNK files; supporting infrastructure was identified on NameCheap-hosted shared servers tied to domains including `yonsei[.]lol`, `rfa[.]ink`, `mitmail[.]tech`, and `newshare[.]online`.
Jun 29, 2026