Kimsuky has expanded its PebbleDash and AppleSeed-related operations with newly documented tooling, including the Rust-based HelloDoor backdoor, httpMalice, MemLoad/httpTroy, AppleSeed, HappyDoor, VSCode Remote Tunneling, and DWAgent. The campaigns use spear-phishing attachments and varied droppers to compromise mainly South Korean public and private entities, with PebbleDash-linked activity also observed against defense organizations in Brazil and Germany. Kaspersky found overlapping distribution methods, target sectors, certificates, mutex patterns, and infrastructure between the PebbleDash and AppleSeed clusters, supporting medium-high confidence attribution to Kimsuky-affiliated clusters. The report highlights Kimsuky's use of legitimate remote access and tunneling services, Korean-language host profiling behavior, possible LLM-assisted Rust malware development, and C2 infrastructure hosted through free Korean domains, compromised websites, Cloudflare tunnels, and Dropbox.