MEDIUMApt
Global

Kimsuky targets organizations with PebbleDash-based tools

·Source: Securelist (Kaspersky)

Updated:

Executive Summary

Kaspersky researchers analyze a range of new PebbleDash-based tools used in recent Kimsuky campaigns and reveal their connection to the AppleSeed malware cluster.

Analysis

Kaspersky researchers analyze a range of new PebbleDash-based tools used in recent Kimsuky campaigns and reveal their connection to the AppleSeed malware cluster.
Source Attribution

Originally published by Securelist (Kaspersky) on May 14, 2026.

Related Threats

MEDIUMApt

Mustang Panda Linked to Updated FDMTP Backdoor in Asia-Pacific Espionage Campaign

Mustang Panda campaign deploys updated FDMTP backdoor against Asia-Pacific and Japan networks

Infosecurity Magazine
MEDIUMApt

Ghostwriter Targets Ukrainian Government With Geofenced PDF Phishing, Cobalt Strike

The Belarus-aligned threat group known as Ghostwriter has been attributed to a fresh set of attacks targeting governmental organizations in Ukraine. Active since at least 2016, Ghostwriter has been linked to both cyber espionage and influence operations targeting neighboring countries, particularly Ukraine. It's also tracked under the monikers FrostyNeighbor, PUSHCHA, Storm-0257, TA445, UAC‑0057

The Hacker News
LOWApt

FlowerStorm phishing gang adopts virtual-machine obfuscation to evade email defenses

A widely active phishing-as-a-service (PhaaS) operation known as FlowerStorm has begun using a browser-based virtual machine to conceal credential theft code, marking what researchers say is an escalation in phishing-kit sophistication that could make attacks harder for traditional email and static-analysis tools to detect. Researchers at Sublime Security said in April that they identified the cam

CSO Online