# APT Spear-Phishing Campaign Targeting South Korean Entities (April 2026) — LNK/PowerShell Loaders, AutoIt, XenoRAT, Infostealers/Keyloggers/Backdoors

> AhnLab ASEC's April 2026 APT report documents an ongoing spear-phishing campaign against domestic South Korean targets. Five distinct attack chains (Types A–E) deliver LNK-triggered PowerShell loaders that fetch AutoIt scripts, HTA infostealers/keyloggers/backdoors, and XenoRAT, abusing legitimate services (PubNub, GitHub, Google Drive) for command-and-control and payload staging, with Task Scheduler persistence masquerading as OneDrive/browser updates.

- **Published:** 2026-05-26T00:00:00Z
- **Last reviewed:** 2026-05-26T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0744
- **ID:** TL-2026-0744
- **Severity:** HIGH
- **Category:** APT
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 24 (full data via the Threadlinqs MCP server — Purple tier)

## Description

AhnLab ASEC's monthly APT threat trend report for April 2026 (domestic South Korea) describes a spear-phishing campaign in which emails disguised as work-related business correspondence deliver malicious LNK shortcut files. Opening an LNK executes embedded PowerShell that initiates one of five observed attack chains.

Type A: A PowerShell command embedded in the LNK uses curl.exe (often renamed) to download a legitimate AutoIt interpreter together with a malicious AutoIt script and a decoy document. The AutoIt script provides command execution, directory enumeration, and file upload/download, and the chain registers a Task Scheduler task masquerading as a system update (e.g., OneDrive, browser updates) for persistence.

Type B: PowerShell inside the LNK extracts HEX-encoded data delimited by specific markers (NCFO, BCFO) to reconstruct and run a legitimate decoy document and a malicious script. C2 is conducted over PubNub channels keyed on the victim's computer name and username; results are Base64-encoded before exfiltration.

Type C: curl.exe downloads malicious HTA (HTML Application) files from GitHub repositories or Google Drive, which load Infostealer, Keylogger, and backdoor modules directly into memory.

Type D: LNK-embedded PowerShell generates Base64 data, accesses GitHub to retrieve and execute decoy files and scripts, and ultimately deploys XenoRAT — an open-source C# remote access trojan offering keylogging, webcam/microphone capture, HVNC, multiple UAC bypasses, SOCKS5 reverse proxy, and process injection — disguised as a browser update.

Type E: XML, VBS, and PowerShell scripts within the LNK establish Task Scheduler persistence and execute malicious Python scripts bundled inside compressed archives, enabling remote command execution and backdoor functionality.

Successful compromise results in backdoor installation, infostealer/keylogger activity, system information leakage, and full system control. AhnLab detected the components as Backdoor/Win.Agent.C5882829, Infostealer/Win.Agent.C5882827, and Trojan variants (LNK.Agent, PS.Agent, HTA.Agent, VBS.Agent, XML.Task). The report does not formally attribute the activity; however, the victimology (South Korean entities), LNK/PowerShell/AutoIt tradecraft, abuse of cloud services for C2, and deployment of XenoRAT are consistent with North Korea–nexus espionage activity (XenoRAT/MoonPeak has been publicly linked to the Kimsuky group), so attribution is assessed at LOW confidence.

## MITRE ATT&CK

- T1566 Phishing
- T1204 User Execution
- T1059 Command and Scripting Interpreter
- T1053 Scheduled Task/Job
- T1036 Masquerading
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1218 System Binary Proxy Execution
- T1055 Process Injection
- T1548 Abuse Elevation Control Mechanism
- T1082 System Information Discovery
- T1033 System Owner/User Discovery
- T1083 File and Directory Discovery
- T1056 Input Capture
- T1113 Screen Capture
- T1123 Audio Capture
- T1125 Video Capture
- T1005 Data from Local System
- T1555 Credentials from Password Stores
- T1102 Web Service
- T1071 Application Layer Protocol
- T1105 Ingress Tool Transfer
- T1573 Encrypted Channel
- T1090 Proxy
- T1041 Exfiltration Over C2 Channel
- T1567 Exfiltration Over Web Service

## Sources

- [APT Attack Threat Report — April 2026 (Domestic Korea, Korean)](https://asec.ahnlab.com/ko/93830/)
- [April 2026 Threat Trend Report on APT Attacks (South Korea, English)](https://asec.ahnlab.com/en/93831/)
- [ASEC Security Research Blog](https://asec.ahnlab.com/en/)
- [Xeno RAT: A New Remote Access Trojan with Advanced Capabilities — CYFIRMA](https://www.cyfirma.com/research/xeno-rat-a-new-remote-access-trojan-with-advance-capabilities/)
- [XenoRAT Malware: Features and Mitigation Strategies — Hunt.io](https://hunt.io/malware-families/xenorat)
- [Malware of the Day — XenoRAT — Active Countermeasures](https://www.activecountermeasures.com/malware-of-the-day-xenorat/)
- [Deep Diving into XenoRAT Malware Campaign — ASM Cybersecurity](https://medium.com/@asmcybersecurity/deep-diving-into-xenorat-malware-campaign-97b1debf2c7a)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0744