--- title: Disclosing new PebbleDash-based tools by Kimsuky | daily.dev description: Kaspersky researchers provide an in-depth technical analysis of new malware tools used by Kimsuky (APT43), a North Korean threat actor. The report covers the... canonical: https://daily.dev/posts/disclosing-new-pebbledash-based-tools-by-kimsuky-6okkr26pn twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Disclosing new PebbleDash-based tools by Kimsuky | daily.dev og:description: Kaspersky researchers provide an in-depth technical analysis of new malware tools used by Kimsuky (APT43), a North Korean threat actor. The report covers the... og:url: https://daily.dev/posts/disclosing-new-pebbledash-based-tools-by-kimsuky-6okkr26pn og:image: https://api.daily.dev/og/posts/6oKKR26pN.png og:image:alt: Disclosing new PebbleDash-based tools by Kimsuky og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Disclosing new PebbleDash-based tools by Kimsuky **[Securelist](https://daily.dev/sources/securelist)** · 27 min read · 0 upvotes · 0 comments ## Summary Kaspersky researchers provide an in-depth technical analysis of new malware tools used by Kimsuky (APT43), a North Korean threat actor. The report covers the PebbleDash and AppleSeed malware clusters, detailing newly discovered variants: HelloDoor (first Rust-based PebbleDash backdoor using Cloudflare tunneling), httpMalice (latest PebbleDash backdoor with Dropbox and HTTP C2 variants), MemLoad (a loader with anti-VM checks that deploys httpTroy), and HappyDoor (an AppleSeed-based backdoor). Post-exploitation tactics include abuse of VSCode Remote Tunneling via GitHub authentication and deployment of the DWAgent remote administration tool. The group primarily targets South Korean defense, government, and public sector entities, with some attacks observed in Brazil and Germany. Infrastructure relies on free South Korean domain hosting, hacked websites, and tunneling services like Cloudflare Quick Tunnels and Ngrok. LLM-generated code comments were found in HelloDoor, suggesting AI-assisted development. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [Iranian hackers targeted major South Korean electronics maker](https://daily.dev/posts/iranian-hackers-targeted-major-south-korean-electronics-maker-73rq7fupn) · BleepingComputer · 0 upvotes · 0 comments - [Cyber Op Targets South Korean Media & Automotive Sectors](https://daily.dev/posts/cyber-op-targets-south-korean-media-automotive-sectors-fhnvdn7ip) · Dark Reading · 0 upvotes · 0 comments - [DPRK APTs: Ted backdoor and curlRAT target South Korean media and automotive sectors](https://daily.dev/posts/dprk-apts-ted-backdoor-and-curlrat-target-south-korean-media-and-automotive-sectors-amz4aeqgp) · Rapid7 Cybersecurity Blog · 0 upvotes · 0 comments --- Tags: [#malware](https://daily.dev/tags/malware) [View this post on daily.dev](https://daily.dev/posts/disclosing-new-pebbledash-based-tools-by-kimsuky-6okkr26pn) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Disclosing new PebbleDash-based tools by Kimsuky","url":"https://daily.dev/posts/disclosing-new-pebbledash-based-tools-by-kimsuky-6okkr26pn","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/disclosing-new-pebbledash-based-tools-by-kimsuky-6okkr26pn"},"datePublished":"2026-05-14T11:06:38.753Z","dateModified":"2026-05-14T11:07:16.761Z","description":"Kaspersky researchers provide an in-depth technical analysis of new malware tools used by Kimsuky (APT43), a North Korean threat actor. The report covers the...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/c2b7790d90707c94d63e033458fc0fd0?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/c2b7790d90707c94d63e033458fc0fd0?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Securelist","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Securelist","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/e4b9f556af7a4e74a179787362dd5b07","url":"https://daily.dev/sources/securelist"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/disclosing-new-pebbledash-based-tools-by-kimsuky-6okkr26pn","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"malware","timeRequired":"PT27M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Securelist","item":"https://daily.dev/sources/securelist"},{"@type":"ListItem","position":3,"name":"Disclosing new PebbleDash-based tools by Kimsuky"}]} ```