# ASEC April 2026 APT Trend Report (South Korea) — Kimsuky-Aligned LNK/PowerShell/AutoIt Spear-Phishing with PubNub C2, GitHub-Hosted HTA & XenoRAT (5 Infection Types)

> AhnLab Security Emergency-response Center (ASEC) documents five distinct APT infection chains observed against South Korean targets during April 2026, all delivered via spear-phishing LNK files attributed to Kimsuky-aligned activity. Notable TTPs include a Type B chain that abuses PubNub pub/sub channels (keyed on victim computer name and username) for C2 with Base64-encoded exfiltration, GitHub- and Google Drive-hosted HTA stagers, AutoIt-based command execution, and XenoRAT deployment via Task Scheduler entries disguised as OneDrive and browser updates.

- **Published:** 2026-05-26T00:00:00Z
- **Last reviewed:** 2026-05-26T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0585
- **ID:** TL-2026-0585
- **Severity:** HIGH
- **Category:** APT
- **Status:** ACTIVE
- **Actor:** Kimsuky (North Korea)
- **Detections:** 9 · **IOCs:** 31 (full data via the Threadlinqs MCP server — Purple tier)

## Description

On 21 May 2026 (English edition) and 26 May 2026 (Korean edition), AhnLab's Security Emergency-response Center (ASEC) published its April 2026 APT Trend Report for South Korea, cataloguing five materially distinct infection chains observed against domestic targets during the month, plus an additional bucket of spear-phishing samples that did not cleanly fit any of the five. ASEC tagged the activity with Kimsuky, XenoRAT, and EndRAT, placing the campaign in the broader operational footprint of the North Korean Kimsuky / Velvet Chollima cluster that has historically targeted South Korean government, academia, defense, foreign-affairs, and dissident communities.

All five chains share a common front end: a spear-phishing email lures the recipient to open a .lnk shortcut, whose command line embeds a PowerShell stager. From there the chains diverge into recognisable Kimsuky tradecraft variants:

Type A — LNK -> embedded PowerShell -> HTTP fetch of curl.exe (renamed to evade naive name-based controls) -> uses the renamed curl to download a legitimate AutoIt3 interpreter and a malicious AutoIt .au3 script -> registers a Task Scheduler entry for persistence. The AutoIt payload implements command execution, directory enumeration, and bidirectional file transfer (upload/download), serving as a lightweight RAT.

Type B — LNK -> PowerShell that parses embedded HEX data between marker tokens such as NCFO and BCFO to reconstruct three artefacts: a legitimate decoy document (opened to placate the user), a legitimate AutoIt3 binary, and a malicious AutoIt script. The artefacts are dropped into C:\ProgramData and a Task Scheduler entry disguised as a Microsoft OneDrive update task is registered. This chain is the most novel of the five: the malicious AutoIt script does NOT use traditional HTTPS C2. Instead it builds a PubNub channel name by concatenating the victim's COMPUTERNAME and USERNAME, subscribes to that channel via the PubNub REST API, accepts operator commands published to the channel, and PUBLISHES the Base64-encoded command output back to the same channel. PubNub is a legitimate global pub/sub messaging service used by tens of thousands of consumer and IoT applications, and its TLS traffic to ps.pndsn.com/pubsub.pubnub.com blends with normal enterprise traffic. The channel-naming convention also yields a per-victim segmentation, identical to Brute Ratel and recent NK uses of cloud pub/sub services for low-volume C2.

Type C — Built-in Windows curl.exe (no renaming) fetches a malicious HTA into %TEMP% and launches it via mshta.exe. The HTA payloads are hosted on attacker-operated GitHub repositories and Google Drive shares, abusing the implicit user-trust of well-known SaaS for staging. The HTA drops a decoy file and a downloader named sys.dll in %TEMP%, which then reflectively loads three in-memory modules: an information stealer, a keylogger, and a backdoor. Targeted exfiltration explicitly includes virtual-asset (cryptocurrency) related data — wallet files, browser-stored exchange credentials, and clipboard contents — consistent with Kimsuky's known financial sub-objective alongside espionage.

Type D — LNK PowerShell drops a Base64-encoded staging script into %TEMP% and executes it. The stager pulls a decoy file and additional malicious scripts from an attacker-controlled GitHub repository, registers a Task Scheduler entry disguised as a browser update, exfiltrates system reconnaissance data, and ultimately deploys XenoRAT. XenoRAT is an open-source C# remote-access trojan whose source has been forked and weaponised by Kimsuky multiple times since 2024.

Type E — LNK bundles XML, VBS, and PowerShell scripts that generate runtime data and register Task Scheduler persistence. PowerShell launched indirectly via wscript.exe (executing the VBS) transmits initial host telemetry to an external endpoint and downloads a BAT file. The BAT extracts and executes a malicious Python script bundled inside a compressed archive (Python interpreter is staged on the host), which ultimately runs a backdoor with remote command execution and file control capabilities.

ASEC also reports a 'Type Unknown' bucket of spear-phishing samples that share the LNK lure pattern but do not cleanly map into Types A-E, indicating active variant development. AhnLab signatures observed across the campaign include Backdoor/Win.Agent.C5882829, Infostealer/Win.Agent.C5882827, Trojan/LNK.Agent, Trojan/PS.Agent, Trojan/HTA.Agent, Trojan/VBS.Agent, and Trojan/XML.Task.

Defenders should treat the PubNub abuse pattern as the highest-priority detection gap: PubNub traffic over TLS to *.pndsn.com or pubsub.pubnub.com from non-developer endpoints is rare in enterprise telemetry, and the per-victim channel naming (computername+username concatenation) is a high-fidelity hunting pivot. The GitHub/Google Drive HTA staging pattern (curl to .hta, mshta execution from %TEMP%) and the cluster of Task Scheduler entries impersonating OneDrive/browser update jobs are also strong host-based detection opportunities.

## MITRE ATT&CK

- T1589 Gather Victim Identity Information
- T1583 Acquire Infrastructure
- T1608 Stage Capabilities
- T1587 Develop Capabilities
- T1566 Phishing
- T1204 User Execution
- T1059 Command and Scripting Interpreter
- T1053 Scheduled Task/Job
- T1036 Masquerading
- T1027 Obfuscated Files or Information
- T1218 System Binary Proxy Execution
- T1140 Deobfuscate/Decode Files or Information
- T1620 Reflective Code Loading
- T1082 System Information Discovery
- T1083 File and Directory Discovery
- T1033 System Owner/User Discovery
- T1056 Input Capture
- T1115 Clipboard Data
- T1555 Credentials from Password Stores
- T1071 Application Layer Protocol
- T1102 Web Service
- T1105 Ingress Tool Transfer
- T1573 Encrypted Channel
- T1041 Exfiltration Over C2 Channel
- T1567 Exfiltration Over Web Service
- T1486 Data Encrypted for Impact

## Sources

- [April 2026 Threat Trend Report on APT Attacks (South Korea) — ASEC English](https://asec.ahnlab.com/en/93831/)
- [2026년 4월 APT 공격 동향 보고서(국내) — ASEC Korean](https://asec.ahnlab.com/ko/93830/)
- [MITRE ATT&CK Group G0094 — Kimsuky](https://attack.mitre.org/groups/G0094/)
- [XenoRAT — GitHub source repository](https://github.com/moom825/xeno-rat)
- [PubNub Pub/Sub REST API documentation (legitimate service abused as C2)](https://www.pubnub.com/docs/sdks/rest-api)
- [LOLBAS — curl.exe entry](https://lolbas-project.github.io/lolbas/Binaries/Curl/)
- [LOLBAS — mshta.exe entry](https://lolbas-project.github.io/lolbas/Binaries/Mshta/)
- [CISA Alert AA20-301A — North Korean Advanced Persistent Threat Focus: Kimsuky](https://www.cisa.gov/news-events/cybersecurity-advisories/aa20-301a)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0585