Attack Cases by the Kimsuky Group Impersonating Diplomats (PebbleDash, PrxClient)

This report documents Kimsuky spear-phishing campaigns in 2026 that use LNK/HTA droppers to deploy PebbleDash backdoors, PrxClient proxy tools, RDP wrapper/backdoor accounts, UAC bypass utilities, and keyloggers; it details delivery and persistence TTPs, command-and-control protocols, supported commands, privilege escalation and RDP patching, and includes multiple IOCs (MD5s, URLs, FQDNs, IPs) for detection and mitigation.