DPRK Actors Leverage VS Code Tunnels for Stealthy Remote Access

DPRK Actors Deploy VS Code Tunnels for Remote Hacking

A spear-phishing campaign linked to the Democratic People’s Republic of Korea (DPRK) is exploiting a legitimate feature within Microsoft Visual Studio Code to achieve full remote control over compromised systems. The campaign, discovered by Darktrace, uses VS Code tunneling to bypass traditional security controls and blend with typical developer activity.

This tactic represents a shift towards living-off-the-land (LotL) techniques, eliminating the need for dedicated command-and-control infrastructure and making detection significantly more challenging, potentially impacting numerous organizations reliant on Microsoft products.

Why This Matters

Traditional security models focus on identifying and blocking known malware signatures. However, this campaign demonstrates the effectiveness of abusing trusted software – a tactic that circumvents these defenses. The cost of a successful compromise using this method could be substantial, ranging from data exfiltration and intellectual property theft to complete system takeover, particularly given the increasing sophistication of nation-state actors.

Key Insights

• VS Code Tunnel Abuse First Observed: Security researchers first identified abuse of VS Code tunnels in 2023.
• LotL Tactics: Attackers are increasingly employing Living-Off-The-Land (LotL) techniques to evade detection by blending malicious activity with legitimate system processes.
• Trusted Infrastructure: Utilizing Microsoft’s infrastructure for tunneling provides a layer of obfuscation and trust, making malicious traffic harder to identify.

Practical Applications

• Use Case: DPRK actors target South Korean organizations with spear-phishing emails disguised as official government communications to install VS Code and establish remote access.
• Pitfall: Over-reliance on signature-based detection can fail to identify malicious activity leveraging trusted software like VS Code.

References:

• https://www.darkreading.com/endpoint-security/dprk-vs-code-tunnels-remote-hacking