CISA, the FBI, and the Department of Defense identified PEBBLEDASH as a full-featured Trojan used by the North Korean government under the HIDDEN COBRA designation. The Windows implant provides file transfer and execution, command-line access, process control, and system-enumeration capabilities. It disguises command-and-control traffic with a simulated TLS handshake and then exchanges RC4-encrypted commands with 112.217.108.138 over port 443. The report supplies file hashes, a YARA rule, and a Snort signature for detection.