ASEC April 2026 APT Trend Report (South Korea) — Kimsuky-Aligned LNK/PowerShell/AutoIt Spear-Phishing with PubNub C2, GitHub-Hosted HTA & XenoRAT (5 Infection Types)
ASEC April 2026 APT Trend Report (South Korea) (TL-2026-0585), also tracked as April 2026 ASEC APT Trend Report (South Korea), is a high-severity advanced persistent threat campaign, first published 2026-05-26. It is attributed to Kimsuky (North Korea) with medium confidence, affects Microsoft Windows, maps to 26 MITRE ATT&CK techniques (T1027, T1033, T1036), and is covered by 9 detection rules and 31 indicators of compromise.
Key facts for TL-2026-0585
- Threat ID
- TL-2026-0585
- Also known as
- April 2026 ASEC APT Trend Report (South Korea), Kimsuky PubNub C2 campaign, Kimsuky LNK/AutoIt April 2026
- Severity
- HIGH
- Status
- ACTIVE
- Category
- APT
- First published
- 2026-05-26
- Last reviewed
- 2026-05-26
- Attribution
- Kimsuky
- Attribution confidence
- MEDIUM
- Nation-state nexus
- North Korea
- Motivation
- ESPIONAGE
- Target sectors
- government, defense, academia, foreign-affairs, think-tank, media, cryptocurrency
- Target regions
- South Korea, East Asia
- Detection rules
- 9
- Indicators of compromise
- 31
Malware and tooling in ASEC April 2026 APT Trend Report (South Korea)
Malware and tooling: EndRAT, XenoRAT, AutoIt3.exe, EndRAT, PubNub Pub/Sub Service, XenoRAT
AhnLab Security Emergency-response Center (ASEC) documents five distinct APT infection chains observed against South Korean targets during April 2026, all delivered via spear-phishing LNK files attributed to Kimsuky-aligned activity. Notable TTPs include a Type B chain that abuses PubNub pub/sub channels (keyed on victim computer name and username) for C2 with Base64-encoded exfiltration, GitHub- and Google Drive-hosted HTA stagers, AutoIt-based command execution, and XenoRAT deployment via Task Scheduler entries disguised as OneDrive and browser updates.
How ASEC April 2026 APT Trend Report (South Korea) works
On 21 May 2026 (English edition) and 26 May 2026 (Korean edition), AhnLab's Security Emergency-response Center (ASEC) published its April 2026 APT Trend Report for South Korea, cataloguing five materially distinct infection chains observed against domestic targets during the month, plus an additional bucket of spear-phishing samples that did not cleanly fit any of the five. ASEC tagged the activity with Kimsuky, XenoRAT, and EndRAT, placing the campaign in the broader operational footprint of the North Korean Kimsuky / Velvet Chollima cluster that has historically targeted South Korean government, academia, defense, foreign-affairs, and dissident communities.
All five chains share a common front end: a spear-phishing email lures the recipient to open a .lnk shortcut, whose command line embeds a PowerShell stager. From there the chains diverge into recognisable Kimsuky tradecraft variants:
Type A — LNK -> embedded PowerShell -> HTTP fetch of curl.exe (renamed to evade naive name-based controls) -> uses the renamed curl to download a legitimate AutoIt3 interpreter and a malicious AutoIt .au3 script -> registers a Task Scheduler entry for persistence. The AutoIt payload implements command execution, directory enumeration, and bidirectional file transfer (upload/download), serving as a lightweight RAT.
Type B — LNK -> PowerShell that parses embedded HEX data between marker tokens such as NCFO and BCFO to reconstruct three artefacts: a legitimate decoy document (opened to placate the user), a legitimate AutoIt3 binary, and a malicious AutoIt script. The artefacts are dropped into C:\ProgramData and a Task Scheduler entry disguised as a Microsoft OneDrive update task is registered. This chain is the most novel of the five: the malicious AutoIt script does NOT use traditional HTTPS C2. Instead it builds a PubNub channel name by concatenating the victim's COMPUTERNAME and USERNAME, subscribes to that channel via the PubNub REST API, accepts operator commands published to the channel, and PUBLISHES the Base64-encoded command output back to the same channel. PubNub is a legitimate global pub/sub messaging service used by tens of thousands of consumer and IoT applications, and its TLS traffic to ps.pndsn.com/pubsub.pubnub.com blends with normal enterprise traffic. The channel-naming convention also yields a per-victim segmentation, identical to Brute Ratel and recent NK uses of cloud pub/sub services for low-volume C2.
Type C — Built-in Windows curl.exe (no renaming) fetches a malicious HTA into %TEMP% and launches it via mshta.exe. The HTA payloads are hosted on attacker-operated GitHub repositories and Google Drive shares, abusing the implicit user-trust of well-known SaaS for staging. The HTA drops a decoy file and a downloader named sys.dll in %TEMP%, which then reflectively loads three in-memory modules: an information stealer, a keylogger, and a backdoor. Targeted exfiltration explicitly includes virtual-asset (cryptocurrency) related data — wallet files, browser-stored exchange credentials, and clipboard contents — consistent with Kimsuky's known financial sub-objective alongside espionage.
Type D — LNK PowerShell drops a Base64-encoded staging script into %TEMP% and executes it. The stager pulls a decoy file and additional malicious scripts from an attacker-controlled GitHub repository, registers a Task Scheduler entry disguised as a browser update, exfiltrates system reconnaissance data, and ultimately deploys XenoRAT. XenoRAT is an open-source C# remote-access trojan whose source has been forked and weaponised by Kimsuky multiple times since 2024.
Type E — LNK bundles XML, VBS, and PowerShell scripts that generate runtime data and register Task Scheduler persistence. PowerShell launched indirectly via wscript.exe (executing the VBS) transmits initial host telemetry to an external endpoint and downloads a BAT file. The BAT extracts and executes a malicious Python script bundled inside a compressed archive (Python interpreter is staged on the host), which ultimately runs a backdoor with remote command execution and file control capabilities.
ASEC also reports a 'Type Unknown' bucket of spear-phishing samples that share the LNK lure pattern but do not cleanly map into Types A-E, indicating active variant development. AhnLab signatures observed across the campaign include Backdoor/Win.Agent.C5882829, Infostealer/Win.Agent.C5882827, Trojan/LNK.Agent, Trojan/PS.Agent, Trojan/HTA.Agent, Trojan/VBS.Agent, and Trojan/XML.Task.
Defenders should treat the PubNub abuse pattern as the highest-priority detection gap: PubNub traffic over TLS to *.pndsn.com or pubsub.pubnub.com from non-developer endpoints is rare in enterprise telemetry, and the per-victim channel naming (computername+username concatenation) is a high-fidelity hunting pivot. The GitHub/Google Drive HTA staging pattern (curl to .hta, mshta execution from %TEMP%) and the cluster of Task Scheduler entries impersonating OneDrive/browser update jobs are also strong host-based detection opportunities.
MITRE ATT&CK techniques used in TL-2026-0585
Defense Evasion
T1027 Obfuscated Files or Information; T1036 Masquerading; T1140 Deobfuscate/Decode Files or Information; T1218 System Binary Proxy Execution; T1620 Reflective Code Loading
Discovery
T1033 System Owner/User Discovery; T1082 System Information Discovery; T1083 File and Directory Discovery
Exfiltration
T1041 Exfiltration Over C2 Channel; T1567 Exfiltration Over Web Service
Persistence
Collection
T1056 Input Capture; T1115 Clipboard Data
Execution
T1059 Command and Scripting Interpreter; T1204 User Execution
Command and Control
T1071 Application Layer Protocol; T1102 Web Service; T1105 Ingress Tool Transfer; T1573 Encrypted Channel
Impact
T1486 Data Encrypted for Impact
Credential Access
T1555 Credentials from Password Stores
Initial Access
Resource Development
T1583 Acquire Infrastructure; T1587 Develop Capabilities; T1608 Stage Capabilities
Reconnaissance
Affected products and versions in ASEC April 2026 APT Trend Report (South Korea)
- Microsoft — Windows
Vulnerable versions: 10; 11; Server 2016; Server 2019; Server 2022 - Microsoft — Microsoft Office
Vulnerable versions: Microsoft 365; Office 2019; Office 2021; Office 2024
Remediation for ASEC April 2026 APT Trend Report (South Korea)
Patches
- No vendor patch — this is a TTP campaign against Windows endpoints. Keep Windows, Office, and browser fully patched as defence-in-depth.
Immediate actions
- Block outbound TLS to ps.pndsn.com and pubsub.pubnub.com from non-developer endpoints; require break-glass exception for legitimate PubNub usage.
- Block the five staging URLs at perimeter proxy: aplore.kesug.com, hypernotepad.com, sixtysixrealestate.com (full URL paths in IOCs).
- Quarantine and hash-block the five MD5 samples published by ASEC across EDR.
- Hunt Task Scheduler entries impersonating OneDrive update or browser update on workstations; baseline against known good vendor jobs.
- Hunt for mshta.exe loading .hta files from %TEMP% and for curl.exe child processes spawning mshta or powershell from %TEMP%.
Workarounds
- For high-value targets, disable mshta.exe execution via WDAC (mshta.exe is rarely required for legitimate business workflows).
- Disable Windows curl.exe for non-administrative users via AppLocker hash rule, or alert on any curl.exe execution outside CI/CD service accounts.
Longer-term hardening
- Disable .lnk auto-execution from Outlook attachments and enforce attachment sandboxing on inbound mail.
- Apply Attack Surface Reduction (ASR) rule 'Block executable content from email client and webmail' (BE9BA2D9-53EA-4CDC-84E5-9B1EEEE46550).
- Apply ASR rule 'Block Office applications from creating child processes' and 'Block JavaScript/VBScript from launching downloaded executable content'.
- Deploy AutoIt3.exe execution policy: block AutoIt3.exe and AutoIt3_x64.exe from user-writable paths via WDAC/AppLocker.
- Deploy DNS sinkhole / SaaS-broker policy to flag first-time PubNub usage per device.
- Restrict Python interpreter execution from user-writable paths via AppLocker/WDAC.
- Deploy LNK execution telemetry (Sysmon event 1 with command-line capture; LOLBAS-aware EDR rules).
Weaknesses (CWE) in ASEC April 2026 APT Trend Report (South Korea)
CWE-77, CWE-829, CWE-94, CWE-506
Timeline of ASEC April 2026 APT Trend Report (South Korea)
- XenoRAT open-source C# RAT published to GitHub (moom825/xeno-rat); subsequently forked and weaponised by Kimsuky operators.
- ASEC observation window opens — first April 2026 Kimsuky-aligned LNK spear-phishing samples processed by AhnLab telemetry against South Korean targets.
- ASEC observation window closes — five distinct infection chains (Types A-E) plus a 'Type Unknown' variant bucket catalogued for the month.
- ASEC publishes April 2026 APT Trend Report (South Korea) English edition disclosing the five chain types, MD5 sample hashes, staging URLs, and AhnLab detection names.
- Threadlinqs Intelligence publishes TL-2026-0585 documenting the five chains, MITRE mapping, and detection guidance with priority on PubNub C2 hunting.
- ASEC publishes the Korean-language edition of the same report (asec.ahnlab.com/ko/93830/).
- As of 2026-05-29, this Kimsuky April 2026 South Korea spear-phishing campaign (PubNub C2, AutoIt, XenoRAT) remains active — ASEC disclosed it just days earlier (May 21-26) and flagged ongoing variant development. Kimsuky/APT43 is undisrupted and prolific in 2026 (FBI Jan-2026 quishing alert, Mar-Apr 2026 ROK targeting); no CVE/patch retires this TTP campaign.
Sources cited for ASEC April 2026 APT Trend Report (South Korea)
- April 2026 Threat Trend Report on APT Attacks (South Korea) — ASEC English
- 2026년 4월 APT 공격 동향 보고서(국내) — ASEC Korean
- MITRE ATT&CK Group G0094 — Kimsuky
- XenoRAT — GitHub source repository
- PubNub Pub/Sub REST API documentation (legitimate service abused as C2)
- LOLBAS — curl.exe entry
- LOLBAS — mshta.exe entry
- CISA Alert AA20-301A — North Korean Advanced Persistent Threat Focus: Kimsuky
Threats related to ASEC April 2026 APT Trend Report (South Korea)
- APT Spear-Phishing Campaign Targeting South Korean Entities (April 2026) — LNK/PowerShell Loaders, AutoIt, XenoRAT, Infostealers/Keyloggers/Backdoors
- Domestic APT Spear-Phishing Campaigns (May 2026) — LNK/HTA/CHM/JSE Loaders Deploying XenoRAT, Suspected Kimsuky
- Mustang Panda Deploys PlugX RAT via Multi-Stage CHM Sideloading Campaign Targeting Persian Gulf Region (March 2026)
Detection coverage for TL-2026-0585
As of 2026-05-26, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0585 across Splunk SPL, Microsoft KQL and Sigma, covering 31 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.