Kimsuky Expands AppleSeed and PebbleDash Intrusions With New Malware and Legitimate Tunnels

North Korea-aligned threat actor Kimsuky has expanded operations across its AppleSeed and PebbleDash intrusion clusters, using spear-phishing documents to gain initial access and then deploying a broader malware set that includes HelloDoor, httpMalice, MemLoad, httpTroy, AppleSeed, and HappyDoor. Researchers assess with medium-high confidence that both clusters are operated by Kimsuky-affiliated actors, also tracked as APT43 and Ruby Sleet, with AppleSeed showing a stronger focus on government organizations while PebbleDash activity has also reached defense-related entities in Brazil and Germany in addition to South Korean targets.

The campaigns show a notable shift in post-compromise tradecraft, with operators increasingly abusing legitimate remote administration and tunneling tools such as VSCode Remote Tunneling, DWAgent, and Cloudflare Quick Tunnels for persistence and access. The report also notes malware development changes including the use of Rust, probable LLM-assisted code comments, and continued reliance on infrastructure patterns tied to free South Korean hosting domains and compromised South Korean websites, indicating that Kimsuky is modernizing its tooling while preserving long-standing operational habits.