DPRK Actors Deploy VS Code Tunnels for Remote Hacking

A North Korean-linked spear-phishing campaign targets South Korean recipients with government-themed lures and malicious JSE files disguised as HWPX documents; when opened the files install Visual Studio Code and create a VS Code tunnel (named "bizeugene") that grants attackers interactive remote access via Microsoft's tunneling service. Darktrace researchers documented the LotL technique, historical precedents of VS Code abuse, provided IoCs and MITRE mappings, and recommended defenses such as least privilege, strong access controls, and monitoring of privileged behavior.