Kimsuky continued spear-phishing operations in 2026 by impersonating diplomatic personnel and using malicious LNK attachments with diplomatic-themed decoy documents. The infection chains deployed PebbleDash for remote control, PrxClient to relay C2 traffic to local RDP, and additional tools for privilege escalation, keylogging, downloading, persistence, and file exfiltration. PebbleDash variants either installed themselves with command-line arguments or injected into LSASS after storing C2 configuration in the registry. ASEC said the recent activity targeted people in the education sector.