Darktrace Identifies Campaign Targeting South Korea Leveraging VS Code for Remote Access

Darktrace researchers identified a campaign aligned with Democratic People’s Republic of Korea (DPRK) activity that targets South Korean users, leveraging Javascript Encoded (JSE) scripts and government-themed decoy documents to deploy a Visual Studio Code tunnel for remote access. The spear-phishing lure is a JSE file disguised in a Hangul Word Processor document, with the decoy Hangul documents impersonating the Ministry of Personnel Management to look legitimate.

The VS Code tunnel is named “bizeugene”, and the attacker uses the VS Code server to establish an encrypted connection to Microsoft’s tunnel service, enabling interactive access via the VS Code application or a web browser after sign‑in with GitHub or Microsoft. A compromised South Korean site, yespp.co[.]kr, is employed as a command-and-control server, where the attacker posts a code and out.txt containing VS Code Server logs and a GitHub device code.

The report also notes that this activity reflects DPRK‑aligned tactics and adds to the growing concern about using legitimate tooling to maintain persistence and evade detection.