Attack Cases by the Kimsuky Group Impersonating Diplomats (PebbleDash, PrxClient)

What Happened

A hacking group called Kimsuky is sending fake emails that appear to come from diplomats. The emails contain disguised malicious files that, when opened, secretly install multiple programs onto the victim's computer. These programs let the attackers remotely control the computer, record keystrokes, and steal files. The attackers also create hidden accounts and modify Windows settings so they can connect to the computer remotely without kicking off the legitimate user. People working in education and diplomacy-related fields are the primary targets. This matters because the stolen information could include sensitive diplomatic or academic data. Individuals should be cautious with email attachments, avoid opening files from unknown sources, and ensure their security software is up to date.

Key Takeaways

• Kimsuky group continues spear phishing campaigns in 2026 impersonating diplomatic personnel, using LNK malware to deliver a multi-tool payload chain
• PebbleDash backdoor is installed via two variants: an argument-triggered type and a registry-config type that injects into LSASS
• Attackers create backdoor RDP accounts (administrator, adminini) and patch termsrv.dll to enable concurrent multi-session RDP on desktop systems
• PrxClient proxy tool relays C2 traffic between attacker infrastructure and local port 3389, enabling stealthy RDP access
• UAC bypass toolkit expanded beyond UACMe to include the open-source SspiUacBypass PoC leveraging NTLM Datagram Context manipulation

Affected Systems

• Windows desktop environments (RDP single-session limitation targeted for patching)
• Individuals in the education sector targeted via diplomatic-themed decoy documents

Vulnerabilities (CVEs)

None identified.

Attack Chain

1. Initial Access: Spear phishing email impersonating diplomatic personnel delivers LNK malware disguised as document files
2. Execution: LNK file executes either PowerShell dropper script or Mshta with embedded HTA script
3. Persistence: Dropper creates downloader/launcher scripts and registers scheduled task 'Windows Templates Update'
4. Installation: Downloader retrieves PebbleDash backdoor, PrxClient proxy, RDP Wrapper, UACMe, and keylogger from C2 server
5. Privilege Escalation: UACMe and SspiUacBypass tools used to bypass UAC for elevated operations
6. Persistence/Access: RDP wrapper activates backdoor accounts (administrator/adminini) and patches termsrv.dll for multi-session RDP; PrxClient proxies C2 to local port 3389 for stealthy RDP access
7. C2 and Exfiltration: PebbleDash communicates with C2 via HTTP URL format for command execution and file exfiltration; keylogger captures keystrokes to %TEMP% and uploads to C2

Detection Availability

• YARA Rules: No
• Sigma Rules: No
• Snort/Suricata Rules: No
• KQL Queries: No
• Splunk SPL Queries: No
• EQL Queries: No
• Other Detection Logic: No

No detection rules (YARA, Sigma, Snort/Suricata, KQL, SPL, EQL) are provided in the article. MD5 hashes, IPs, domains, and URLs are listed as IOCs for manual blocking and hunting.

Detection Engineering Assessment

Required Log Sources

• Process creation events (Sysmon Event ID 1 / Windows Security Event ID 4688)
• Scheduled task creation logs (Sysmon Event ID 11, Windows Task Scheduler logs)
• Registry modification events (Sysmon Event ID 12/13/14)
• Network connection events (Sysmon Event ID 3, firewall logs)
• RDP connection logs (Windows Terminal Services logs, Event ID 4624 Logon Type 10)
• User account creation/activation events (Windows Security Event ID 4720, 4722)
• File creation events in atypical paths like %APPDATA%\Microsoft\Windows\Templates

Hunting Hypotheses

Control Gaps

• Signature-based AV may miss obfuscated PowerShell download commands and HTA scripts embedded in LNK files
• Network-based detection may not flag HTTP C2 traffic on port 8080 if it blends with legitimate web proxy traffic
• RDP multi-session patching via termsrv.dll replacement may not be monitored by standard file integrity controls
• PrxClient proxy relay traffic to localhost:3389 may appear as legitimate local RDP activity if process-level network telemetry is not correlated
• UAC bypass via SspiUacBypass using NTLM Datagram Context manipulation may evade standard UAC bypass detections tuned for UACMe techniques

Key Behavioral Indicators

• Mshta.exe spawned by explorer.exe with an LNK file as argument (T1218.011)
• PowerShell or Mshta creating files in %APPDATA%\Microsoft\Windows\Templates\ path
• Scheduled task creation with name 'Windows Templates Update'
• Process injection into LSASS from sqliom.dll or similar non-Microsoft DLL
• Activation of built-in administrator account via net.exe or batch script
• File replacement of C:\Windows\System32\termsrv.dll
• Unknown executables binding to local port 3389 and connecting to external IPs on port 8080
• Registry value written to HKLM\SYSTEM\CurrentControlSet\Control\WMI\Security with GUID-like value name

False Positive Assessment

Recommendations

Immediate Mitigation

Infrastructure Hardening

• Evaluate whether disabling RDP on desktop endpoints is feasible, or restrict RDP access to specific management jump hosts via network segmentation.
• Consider implementing file integrity monitoring for C:\Windows\System32\termsrv.dll to detect RDP Patcher activity.
• If supported by your email security gateway, consider adding blocking rules for LNK attachments and diplomatic-themed decoy documents from external senders.
• Consider enabling Windows Event Log forwarding for account creation/activation events (4720, 4722) and RDP logon events (4624 Logon Type 10) to a central SIEM for correlation.

User Protection

• Consider deploying enhanced endpoint detection rules for Mshta execution from LNK files and PowerShell download cradles if your EDR supports custom behavioral rules.
• If applicable, consider enabling Attack Surface Reduction (ASR) rules to block Mshta and PowerShell child processes spawned from Office applications or LNK files.
• Evaluate whether your endpoint solution can alert on process injection into LSASS by non-Microsoft signed DLLs.

Security Awareness

• Consider incorporating diplomatic-themed phishing scenarios into existing security awareness training programs, emphasizing that LNK files and unexpected script attachments are not legitimate documents.
• Consider reminding users in education and diplomatic sectors to verify sender authenticity through out-of-band channels before opening attachments claiming to be diplomatic documents.
• If your organization has a reporting mechanism, consider encouraging users to report suspicious emails with LNK or HTA attachments rather than opening them.

MITRE ATT&CK Mapping

Additional IOCs

• Domains:
  • mpo4wj[.]scienceontheweb[.]net - C2 domain associated with Kimsuky attack infrastructure
  • p563q1[.]sportsontheweb[.]net - C2 domain associated with Kimsuky attack infrastructure
• Urls:
  • hxxp://edcvbgtrf[.]medianewsonline[.]com/rdpwrap.dll - Download URL for RDP wrapper DLL component
• File Hashes:
  • 00f27b3cf8817313aafdfc29ff238153 (MD5) - MD5 hash of malware sample used in Kimsuky attack
  • 029db651367bb1eac0a85bd826afe420 (MD5) - MD5 hash of malware sample used in Kimsuky attack
  • 07010ef323ff1a6efebf9c59f8afb35f (MD5) - MD5 hash of malware sample used in Kimsuky attack
  • 0a5f8bb2aebb296b6a5048ca5b85d8ad (MD5) - MD5 hash of malware sample used in Kimsuky attack
  • 0c0a44de58b0a47b749411a9c2fe178e (MD5) - MD5 hash of malware sample used in Kimsuky attack
• Registry Keys:
  • HKLM\SYSTEM\CurrentControlSet\Control\WMI\Security\CC1CFAFD-D1B4-4303-8C2C-0BC4E3C54B5C - Registry value where PebbleDash second variant stores decrypted C2 configuration data
• File Paths:
  • %PUBLIC%\Downloads\DefenderUpdate.Js - Downloader script dropped by PowerShell dropper in Case Study 1
  • %APPDATA%\Microsoft\Windows\Templates\Templates.Js - Launcher script created by HTA dropper in Case Study 2
  • %APPDATA%\Microsoft\Windows\Templates\Templates.Ps1 - PowerShell script executed by Templates.Js launcher in Case Study 2
  • %SystemDirectory%\sqliom.Dll - Injector DLL created by PebbleDash second variant to inject into LSASS
  • %TEMP%\Log.<USERNAME>.BIN - Keylogger output file storing captured keystrokes before exfiltration
  • C:\temp.Dll - Patched termsrv.dll saved by RDP Patcher before replacing the legitimate file
• Command Lines:
  • Purpose: PrxClient proxy execution relaying C2 traffic to local RDP port | Tools: PrxClient | Stage: C2 Relay
  • Purpose: PebbleDash first variant installation trigger via specific argument | Tools: PebbleDash | Stage: Installation | <pebbledash_path> QCvt5676hZXbg
  • Purpose: PebbleDash first variant C2 connection trigger via specific argument | Tools: PebbleDash | Stage: C2 Communication | <pebbledash_copy_path>\smss.Exe mJnZzaCN2RnFG
  • Purpose: PebbleDash second variant installation trigger via specific argument | Tools: PebbleDash | Stage: Installation | <pebbledash2_path> edcVFRtgbNHY6
  • Purpose: RDP wrapper activation of administrator account and RDP service | Tools: rdpwrap.bat, net user, net localgroup, reg add | Stage: Persistence | rdpwrap.bat (activates administrator account, enables RDP service)
• Other:
  • Windows Templates Update - Scheduled task name registered by HTA dropper for persistence of Templates.Js launcher
  • administrator - Backdoor account activated by rdpwrap.bat for RDP access
  • adminini - Alternate backdoor account created by threat actor for RDP access