ASEC April 2026 APT Trend Report (South Korea) — Kimsuky-Aligned LNK/PowerShell/AutoIt Spear-Phishing with PubNub C2, GitHub-Hosted HTA & XenoRAT (5 Infection Types) — Threadlinqs Intelligence
As of 2026-05-30, ASEC April 2026 APT Trend Report (South Korea) — Kimsuky-Aligned LNK/PowerShell/AutoIt Spear-Phishing with PubNub C2, GitHub-Hosted HTA & XenoRAT (5 Infection Types) is a high-severity apt threat attributed to Kimsuky (North Korea), tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 31 indicators of compromise.
Threat ID: TL-2026-0585 · Severity: HIGH · Status: ACTIVE · Category: APT
Attribution: Kimsuky · North Korea · ESPIONAGE
AhnLab Security Emergency-response Center (ASEC) documents five distinct APT infection chains observed against South Korean targets during April 2026, all delivered via spear-phishing LNK files
On 21 May 2026 (English edition) and 26 May 2026 (Korean edition), AhnLab's Security Emergency-response Center (ASEC) published its April 2026 APT Trend Report for South Korea, cataloguing five materially distinct infection chains observed against domestic targets during the month, plus an additional bucket of spear-phishing samples that did not cleanly fit any of the five. ASEC tagged the activity with Kimsuky, XenoRAT, and EndRAT, placing the campaign in the broader operational footprint of the North Korean Kimsuky / Velvet Chollima cluster that has historically targeted South Korean government, academia, defense, foreign-affairs, and dissident communities.
All five chains share a common front end: a spear-phishing email lures the recipient to open a .lnk shortcut, whose command line embeds a PowerShell stager. From there the chains diverge into recognisable Kimsuky tradecraft variants:
Type A — LNK -> embedded PowerShell -> HTTP fetch of curl.exe (renamed to evade naive name-based controls) -> uses the renamed curl to download a legitimate AutoIt3 interpreter and a malicious AutoIt .au3 script -> registers a Task Scheduler entry for persistence. The AutoIt payload implements command execution, directory enumeration, and bidirectional file transfer (upload/download), serving as a lightweight RAT.
Type B — LNK -> PowerShell that parses embedded HEX data between marker tokens such as NCFO and BCFO to reconstruct three artefacts: a legitimate decoy document (opened to placate the user), a legitimate AutoIt3 binary, and a malicious AutoIt script. The artefacts are dropped into C:\ProgramData and a Task Scheduler entry disguised as a Microsoft OneDrive update task is registered. This chain is the most novel of the five: the malicious AutoIt script does NOT use traditional HTTPS C2. Instead it builds a PubNub channel name by concatenating the victim's COMPUTERNAME and USERNAME, subscribes to that channel via the PubNub REST API, accepts operator commands published to the channel, and PUBLISHES the Base64-encoded command output back to the same channel. PubNub is a legitimate global pub/sub messaging service used by tens of thousands of consumer and IoT applications, and its TLS traffic to ps.pndsn.com/pubsub.pubnub.com blends with normal enterprise traffic. The channel-naming convention also yields a per-victim segmentation, identical to Brute Ratel and recent NK uses of cloud pub/sub services for low-volume C2.
Type C — Built-in Windows curl.exe (no renaming) fetches a malicious HTA into %TEMP% and launches it via mshta.exe. The HTA payloads are hosted on attacker-operated GitHub repositories and Google Drive shares, abusing the implicit user-trust of well-known SaaS for staging. The HTA drops a decoy file and a downloader named sys.dll in %TEMP%, which then reflectively loads three in-memory modules: an information stealer, a keylogger, and a backdoor. Targeted exfiltration explicitly includes virtual-asset (cryptocurrency) related data — wallet files, browser-stored exchange credentials, and clipboard contents — consistent with Kimsuky's known financial sub-objective alongside espionage.
Type D — LNK PowerShell drops a Base64-encoded staging script into %TEMP% and executes it. The stager pulls a decoy file and additional malicious scripts from an attacker-controlled GitHub repository, registers a Task Scheduler entry disguised as a browser update, exfiltrates system reconnaissance data, and ultimately deploys XenoRAT. XenoRAT is an open-source C# remote-access trojan whose source has been forked and weaponised by Kimsuky multiple times since 2024.
Type E — LNK bundles XML, VBS, and PowerShell scripts that generate runtime data and register Task Scheduler persistence. PowerShell launched indirectly via wscript.exe (executing the VBS) transmits initial host telemetry to an external endpoint and downloads a BAT file. The BAT extracts and executes a malicious Python script bundled inside a compressed archive (Python interpret
Weaknesses (CWE)
CWE-77, CWE-829, CWE-94, CWE-506
Target sectors: government, defense, academia, foreign-affairs, think-tank, media, cryptocurrency
Target regions: South Korea, East Asia
Detections & IOCs
As of 2026-07-20, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 31 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
APT, HIGH, threat intelligence, cybersecurity, T1589, T1583, T1583, T1608, T1587, T1566, T1566, T1204, T1204, T1059