APT Spear-Phishing Campaign Targeting South Korean Entities (April 2026) — LNK/PowerShell Loaders, AutoIt, XenoRAT, Infostealers/Keyloggers/Backdoors
APT Spear-Phishing Campaign Targeting South Korean Entities (TL-2026-0744), also tracked as April 2026 ASEC APT Report (Domestic Korea), is a high-severity advanced persistent threat campaign, first published 2026-05-26. It carries a reported North Korea nexus and is not formally attributed, affects Microsoft Windows, maps to 26 MITRE ATT&CK techniques (T1005, T1027, T1033), and is covered by 9 detection rules and 24 indicators of compromise.
Key facts for TL-2026-0744
- Threat ID
- TL-2026-0744
- Also known as
- April 2026 ASEC APT Report (Domestic Korea)
- Severity
- HIGH
- Status
- ACTIVE
- Category
- APT
- First published
- 2026-05-26
- Last reviewed
- 2026-05-26
- Attribution confidence
- NONE
- Nation-state nexus
- North Korea
- Motivation
- ESPIONAGE
- Target sectors
- government, defense, academia, think-tanks
- Target regions
- South Korea, East Asia
- Detection rules
- 9
- Indicators of compromise
- 24
Malware and tooling in APT Spear-Phishing Campaign Targeting South Korean Entities
Malware and tooling: XenoRAT, AutoIt3, GitHub, Google Drive, PubNub, curl.exe
AhnLab ASEC's April 2026 APT report documents an ongoing spear-phishing campaign against domestic South Korean targets. Five distinct attack chains (Types A–E) deliver LNK-triggered PowerShell loaders that fetch AutoIt scripts, HTA infostealers/keyloggers/backdoors, and XenoRAT, abusing legitimate services (PubNub, GitHub, Google Drive) for command-and-control and payload staging, with Task Scheduler persistence masquerading as OneDrive/browser updates.
How APT Spear-Phishing Campaign Targeting South Korean Entities works
AhnLab ASEC's monthly APT threat trend report for April 2026 (domestic South Korea) describes a spear-phishing campaign in which emails disguised as work-related business correspondence deliver malicious LNK shortcut files. Opening an LNK executes embedded PowerShell that initiates one of five observed attack chains.
Type A: A PowerShell command embedded in the LNK uses curl.exe (often renamed) to download a legitimate AutoIt interpreter together with a malicious AutoIt script and a decoy document. The AutoIt script provides command execution, directory enumeration, and file upload/download, and the chain registers a Task Scheduler task masquerading as a system update (e.g., OneDrive, browser updates) for persistence.
Type B: PowerShell inside the LNK extracts HEX-encoded data delimited by specific markers (NCFO, BCFO) to reconstruct and run a legitimate decoy document and a malicious script. C2 is conducted over PubNub channels keyed on the victim's computer name and username; results are Base64-encoded before exfiltration.
Type C: curl.exe downloads malicious HTA (HTML Application) files from GitHub repositories or Google Drive, which load Infostealer, Keylogger, and backdoor modules directly into memory.
Type D: LNK-embedded PowerShell generates Base64 data, accesses GitHub to retrieve and execute decoy files and scripts, and ultimately deploys XenoRAT — an open-source C# remote access trojan offering keylogging, webcam/microphone capture, HVNC, multiple UAC bypasses, SOCKS5 reverse proxy, and process injection — disguised as a browser update.
Type E: XML, VBS, and PowerShell scripts within the LNK establish Task Scheduler persistence and execute malicious Python scripts bundled inside compressed archives, enabling remote command execution and backdoor functionality.
Successful compromise results in backdoor installation, infostealer/keylogger activity, system information leakage, and full system control. AhnLab detected the components as Backdoor/Win.Agent.C5882829, Infostealer/Win.Agent.C5882827, and Trojan variants (LNK.Agent, PS.Agent, HTA.Agent, VBS.Agent, XML.Task). The report does not formally attribute the activity; however, the victimology (South Korean entities), LNK/PowerShell/AutoIt tradecraft, abuse of cloud services for C2, and deployment of XenoRAT are consistent with North Korea–nexus espionage activity (XenoRAT/MoonPeak has been publicly linked to the Kimsuky group), so attribution is assessed at LOW confidence.
MITRE ATT&CK techniques used in TL-2026-0744
Collection
T1005 Data from Local System; T1056 Input Capture; T1113 Screen Capture; T1123 Audio Capture; T1125 Video Capture
Defense Evasion
T1027 Obfuscated Files or Information; T1036 Masquerading; T1055 Process Injection; T1140 Deobfuscate/Decode Files or Information; T1218 System Binary Proxy Execution
Discovery
T1033 System Owner/User Discovery; T1082 System Information Discovery; T1083 File and Directory Discovery
Exfiltration
T1041 Exfiltration Over C2 Channel; T1567 Exfiltration Over Web Service
Persistence
Execution
T1059 Command and Scripting Interpreter; T1204 User Execution
Command and Control
T1071 Application Layer Protocol; T1090 Proxy; T1102 Web Service; T1105 Ingress Tool Transfer; T1573 Encrypted Channel
privilege-escalation
T1548 Abuse Elevation Control Mechanism
Credential Access
T1555 Credentials from Password Stores
Initial Access
Affected products and versions in APT Spear-Phishing Campaign Targeting South Korean Entities
- Microsoft — Windows
Vulnerable versions: 10; 11; Server
Remediation for APT Spear-Phishing Campaign Targeting South Korean Entities
Immediate actions
- Block the identified staging URLs/domains (aplore.kesug.com, hypernotepad.com, sixtysixrealestate.com) at the web proxy and DNS layer
- Alert/quarantine on the five MD5 hashes across EDR and mail gateways
- Quarantine inbound emails carrying LNK attachments or links to LNK/HTA payloads
Workarounds
- Disable mshta.exe execution via WDAC/AppLocker where not required
- Change default file association for .lnk handling and block .lnk delivery in email
Longer-term hardening
- Deploy EDR with behavioral detection for LNK-spawned PowerShell, renamed curl.exe, and AutoIt interpreter abuse
- Restrict or monitor outbound traffic to PubNub, raw GitHub, and Google Drive from endpoints that have no business need
- Implement application control to block execution of HTA (mshta.exe) and unsigned AutoIt/Python interpreters
- Enforce Scheduled Task creation auditing and alert on tasks impersonating OneDrive/browser updater names
Timeline of APT Spear-Phishing Campaign Targeting South Korean Entities
- XenoRAT open-source C# remote access trojan publicly released on GitHub; later adopted by espionage actors targeting Korean entities.
- CYFIRMA publishes the first detailed public analysis of XenoRAT, documenting its keylogging, webcam/microphone capture, HVNC, UAC bypass, SOCKS5 reverse proxy, and process-injection capabilities.
- Active Countermeasures ('Malware of the Day') profiles XenoRAT's network beaconing behavior, establishing C2 traffic patterns later seen in Korea-targeted campaigns.
- Spear-phishing campaign against domestic South Korean targets active during April 2026, using LNK-triggered PowerShell loaders observed by AhnLab.
- Type D chain observed deploying XenoRAT disguised as a browser update via GitHub-staged Base64 payloads.
- AhnLab detection engine flags campaign components as Backdoor/Win.Agent.C5882829, Infostealer/Win.Agent.C5882827, and Trojan variants (LNK/PS/HTA/VBS/XML.Agent).
- End of the April 2026 reporting period covered by the AhnLab ASEC APT trend report.
- Five MD5 hashes and five malicious staging URLs released as indicators of compromise.
- AhnLab ASEC publishes the April 2026 APT Attack Threat Report (domestic Korea) with malware analysis and IOCs.
Sources cited for APT Spear-Phishing Campaign Targeting South Korean Entities
- APT Attack Threat Report — April 2026 (Domestic Korea, Korean)
- April 2026 Threat Trend Report on APT Attacks (South Korea, English)
- ASEC Security Research Blog
- Xeno RAT: A New Remote Access Trojan with Advanced Capabilities — CYFIRMA
- XenoRAT Malware: Features and Mitigation Strategies — Hunt.io
- Malware of the Day — XenoRAT — Active Countermeasures
- Deep Diving into XenoRAT Malware Campaign — ASM Cybersecurity
Threats related to APT Spear-Phishing Campaign Targeting South Korean Entities
Detection coverage for TL-2026-0744
As of 2026-05-26, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0744 across Splunk SPL, Microsoft KQL and Sigma, covering 24 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.
Community OSINT corroboration for TL-2026-0744
6 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.