Xctdoor Backdoor Delivered via Resume-Themed LNK Files, PowerShell/VBScript Loaders, and ProximityUxHost.exe DLL Side-Loading (Andariel)

Key facts for Xctdoor resume LNK lures

Detection coverage for Xctdoor resume LNK lures

As of 2026-06-19, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0869 across Splunk SPL, Microsoft KQL and Sigma, covering 24 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Xctdoor HTTP C2 Beacon — Injected Trusted Process to Non-Microsoft Host (C2/Lateral)

Detects Xctdoor command-and-control: a normally non-networking host process (taskhostw.exe, taskhost.exe, taskhostex.exe, explorer.exe) — the process-injection/hollowing targets — initiating outbound HTTP to a non-Microsoft destination, including the known C2 indicators 195.50.242.110:8080 and beebeep.info/index.php. Xctdoor obfuscates the beacon body with the mt19937 PRNG keystream plus Base64 at a fixed interval+jitter. Flags both the known IOCs and the anomalous trusted-process-as-HTTP-client behavior.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1071.001, T1132.001, T1105, T1041, T1055.012
• Data sources: sysmon, microsoft_defender_for_endpoint, zeek, firewall, proxy
• Severity: critical
• Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=3
| where match(Image, "(?i)\\\\(taskhostw|taskhost|taskhostex|explorer)\.exe$")
| where Initiated="true" AND (DestinationPort=80 OR DestinationPort=8080 OR DestinationPort=443)
| eval known_ioc=if(DestinationIp="195.50.242.110" OR like(DestinationHostname,"%beebeep.info%"), "known_c2", "anomalous_trusted_proc_http")
| where NOT match(DestinationHostname, "(?i)(microsoft|windows|msftncsi|office365|windowsupdate)\.com$")
| stats count min(_time) as firstTime max(_time) as lastTime values(DestinationIp) as dest_ip values(DestinationHostname) as dest_host values(DestinationPort) as dest_port by host, Image, known_ioc
| convert ctime(firstTime) ctime(lastTime)
| sort - count

Microsoft KQL

DeviceNetworkEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName in~ ("taskhostw.exe","taskhost.exe","taskhostex.exe","explorer.exe")
| where RemotePort in (80, 8080, 443)
| where RemoteIP == "195.50.242.110" or RemoteUrl has "beebeep.info"
    or (isnotempty(RemoteUrl) and RemoteUrl !has "microsoft.com" and RemoteUrl !has "windows.com" and RemoteUrl !has "msftncsi.com")
| extend Verdict = iff(RemoteIP == "195.50.242.110" or RemoteUrl has "beebeep.info", "known_c2", "anomalous_trusted_proc_http")
| project Timestamp, DeviceName, InitiatingProcessFileName, RemoteIP, RemoteUrl, RemotePort, Verdict
| order by Timestamp desc

Sigma

title: Xctdoor C2 Beacon From Injected Trusted Process
id: 4d9a1c63-7e22-4b08-9a51-3b0e6f8c2d03
status: experimental
description: Detects taskhostw.exe/explorer.exe and related processes making outbound HTTP to the Xctdoor C2 (195.50.242.110, beebeep.info) or to any non-Microsoft host shortly after DLL side-load, indicating process injection and C2 beaconing.
references:
    - https://asec.ahnlab.com/en/74835/
    - https://cyberpress.org/resume-lures-deliver-xctdoor/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/06/19
tags:
    - attack.command_and_control
    - attack.t1071.001
    - attack.t1132.001
    - attack.t1105
    - attack.exfiltration
    - attack.t1041
logsource:
    product: windows
    category: network_connection
detection:
    selection_proc:
        Image|endswith:
            - '\taskhostw.exe'
            - '\taskhost.exe'
            - '\taskhostex.exe'
            - '\explorer.exe'
        Initiated: 'true'
    selection_ioc:
        DestinationIp: '195.50.242.110'
        DestinationHostname|contains: 'beebeep.info'
    condition: selection_proc and selection_ioc
falsepositives:
    - explorer.exe shell-opened URLs from genuine user browsing (validate process-injection context and destination)
level: critical

Known false positives:

• explorer.exe opening user-clicked URLs in a default handler
• Legitimate task host telemetry to Microsoft endpoints (excluded by the host filter)

Tuning notes: Feed the known C2 IOCs (195.50.242.110, beebeep.info) into a threat-intel lookup for immediate high-confidence alerting. For the anomalous-process branch, baseline normal explorer.exe destinations per environment and exclude corporate proxies. Correlate with SPL-001/SPL-002 and image_load of ProximityCommon.dll within the prior hour to raise confidence.

• 🔒 ProximityUxHost DLL Side-Loading of Non-Default [indicator] (Exploitation) · unlock with TL Creds
• 🔒 Xctdoor Process Injection into Trusted Task Host Processes (Post-Exploitation) · unlock with TL Creds
• 🔒 Xctdoor mt19937+Base64 HTTP C2 Beacon to Known Indicators (C2/Lateral) · unlock with TL Creds
• 🔒 Xctdoor Payload Staging — [indicator]/[indicator]/ProximityUxHost Dropped to Public Dirs (Exploitation) · unlock with TL Creds
• 🔒 Resume-Themed LNK Spawning Script Interpreters / curl Staging (Exploitation Initial Access) · unlock with TL Creds
• 🔒 Xctdoor Startup-Folder Shortcut Persistence — [indicator] / [indicator] (Post-Exploitation) · unlock with TL Creds
• 🔒 Xctdoor Script Loader Execution from Public Videos/Pictures (Exploitation) · unlock with TL Creds
• 🔒 Office365-Named Scheduled Task Running WScript from Public Dir (Post-Exploitation Persistence) · unlock with TL Creds

Indicators of compromise for Xctdoor resume LNK lures

As of 2026-06-19, Threadlinqs Intelligence tracks 24 indicators of compromise for TL-2026-0869.

Sample indicators (3 of 24)

• IP address: 195.50.242[.]110
• Domain: beebeep[.]info
• File hash: ad96a8f22faab8b9c361cfccc381cd28

Defanged, TLP:CLEAR. Full set of 24 indicators: unlock with TL Creds.

How Xctdoor resume LNK lures works

Persistence uses a Task Scheduler entry named 'Office365' that runs a VBScript every ten minutes plus a startup-folder shortcut.

ASEC (AhnLab Security Intelligence Center) and corroborating reporting describe an active social-engineering malware campaign targeting corporate recruitment, HR, sales, and customer-support teams with malicious LNK files masquerading as job resumes (naming pattern '(RESUME)Company_JobTitle***.LNK'). Opening the shortcut displays a decoy resume document while hidden batch, PowerShell (.ps1), and VBScript (.vbs) loaders with randomized names execute from C:\Users\Public\Videos\ and C:\Users\Public\Pictures\. A second-stage PowerShell script (p2.ps1) retrieves and Base64-decodes additional components, including the legitimate, signed ProximityUxHost.exe, a malicious ProximityCommon.dll, and the encrypted settings.dat payload.

The attack abuses DLL side-loading (T1574.002): launching the trusted ProximityUxHost.exe causes it to load the adversary's ProximityCommon.dll from the same directory, executing malicious code under the cover of a signed Microsoft binary. The DLL reconstructs and loads settings.dat, the Xctdoor backdoor. Xctdoor (a Go-based evolution tied to the older HotCroissant family and delivered by the XcLoader injector that was rewritten from C to Go) injects itself into legitimate processes such as taskhost.exe, taskhostex.exe, taskhostw.exe, and explorer.exe via process injection/hollowing, then establishes HTTP command-and-control. Outbound traffic is obfuscated using the Mersenne Twister (mt19937) pseudo-random generator combined with Base64 encoding. Backdoor capabilities include screenshot capture, keylogging, clipboard theft, drive and system information collection (username, computer name, PID), arbitrary command execution, and secondary payload delivery.

Persistence is multi-layered: a scheduled task named 'Office365' (masquerading as a Microsoft service) executes a VBScript every ten minutes, surviving reboots and security-tool termination, and a startup shortcut (Microsoft.Bing.lnk; the Andariel ERP/web-server variants used MicrosoftEdge.lnk with a copy at %LOCALAPPDATA%\Packages\Microsoft.MicrosoftEdge.Current_8wekyb3d8bbwe\Settings\roaming.dat) re-launches the implant at logon. The Andariel cluster (a subgroup of the Lazarus Group, North Korea) has used Xctdoor against South Korean defense and manufacturing organizations, historically pivoting through ERP solutions and Internet-facing IIS web servers; the C2 195.50.242.110:8080 traces to the HotCroissant predecessor and hxxp://beebeep[.]info/index.php to Xctdoor operations.

MITRE ATT&CK techniques by tactic:

Discovery

T1033 System Owner/User Discovery; T1082 System Information Discovery

Defense Evasion

T1036 Masquerading; T1055 Process Injection; T1140 Deobfuscate/Decode Files or Information; T1574 Hijack Execution Flow

Exfiltration

T1041 Exfiltration Over C2 Channel

Persistence

T1053 Scheduled Task/Job; T1547 Boot or Logon Autostart Execution

Collection

T1056 Input Capture; T1113 Screen Capture; T1115 Clipboard Data

Execution

T1059 Command and Scripting Interpreter; T1204 User Execution

Command and Control

T1071 Application Layer Protocol; T1105 Ingress Tool Transfer; T1132 Data Encoding

Initial Access

T1566 Phishing

Remediation for Xctdoor resume LNK lures

Immediate actions

• Hunt for and delete the 'Office365' scheduled task that launches a VBScript every 10 minutes from user-writable paths
• Quarantine ProximityCommon.dll, settings.dat, p2.ps1, Microsoft.Bing.lnk, MicrosoftEdge.lnk, and roaming.dat from C:\Users\Public\Videos\, C:\Users\Public\Pictures\, Startup folders, and the Microsoft.MicrosoftEdge package Settings path
• Block C2 indicators 195.50.242.110 and beebeep.info at the perimeter/DNS
• Isolate hosts showing ProximityUxHost.exe loading a non-default ProximityCommon.dll or injecting into taskhostw.exe/explorer.exe

Workarounds

• Disable Windows Script Host (wscript/cscript) where not required to break VBScript persistence
• Configure scheduled-task creation auditing (Event ID 4698) and alert on tasks named after Microsoft products

Longer-term hardening

• Deploy EDR with behavioral DLL-side-loading and process-injection detection
• Restrict execution from C:\Users\Public\ and other world-writable directories via WDAC/AppLocker
• Enforce LNK-attachment filtering and user awareness for resume/HR-themed lures
• Enable PowerShell script-block and module logging and monitor curl/Base64 staging behavior

Affected and fixed versions

• Microsoft — Windows
  Vulnerable versions: 10; 11; Server

Timeline of Xctdoor resume LNK lures

• 2015-11-01 Rifdoor, the earliest backdoor in the Andariel lineage that later evolved into HotCroissant and locked-ioc-23, first discovered in the wild.
• 2017-01-01 Korean ERP solution abused: a malicious routine inserted into ClientUpdater.exe distributes the HotCroissant backdoor (Rifdoor variant). C2 locked-ioc-16:8080 is tied to this North Korean lineage.
• 2017-12-01 AhnLab detection signatures dated for the Rifdoor and Andaridown variants, marking continued tracking of the Andariel backdoor lineage that precedes locked-ioc-23.
• 2020-01-01 US CISA and VMware Carbon Black publicly disclosed analysis of the HotCroissant backdoor and its connection to Lazarus/Andariel operations.
• 2024-03-01 Andariel compromises Internet-facing Windows IIS 8.5 web servers in South Korea, installing the Go-language locked-ioc-22 injector on manufacturing-sector systems to deploy locked-ioc-23.
• 2024-05-01 Andariel conducts ERP-solution-based attacks against South Korean defense and manufacturing firms, deploying locked-ioc-23 via a modified ClientUpdater.exe; the 'XctMain' development keyword is identified in the malware.
• 2024-06-01 ASEC (AhnLab) publishes a comprehensive analysis of the locked-ioc-23 backdoor and the locked-ioc-22 injector (rewritten from C to Go), attributing the campaign to Andariel.
• 2026-06-18 Active resume-themed LNK campaign delivering locked-ioc-23 via PowerShell/VBScript/batch loaders and locked-ioc-13 DLL side-loading reported, targeting recruitment, HR, sales, and customer-support teams; persistence via an 'locked-ioc-21' scheduled task running a VBScript every ten minutes.

Sources cited for Xctdoor resume LNK lures

• Xctdoor Malware Used in Attacks Against Korean Companies (Andariel) - ASEC asec.ahnlab.com · Research · 2024-06-01
• MITRE ATT&CK Group: Andariel (G0138) MITRE · Research · 2024-01-01
• The Xctdoor Backdoor Ecosystem: Memory-Resident Go Architectures and HR-Vector Weaponization brinztech.com · Blog · 2026-06-18
• Hackers Abuse PowerShell to Deliver Xctdoor Backdoor cybersecuritynews.com · News · 2026-06-18
• Malicious LNK Files Disguised as Job Resumes Target Corporate Employees gbhackers.com · News · 2026-06-18
• Hackers Use Resume-Themed LNK Files to Deploy Xctdoor Backdoor via DLL Side Loading cyberpress.org · News · 2026-06-18

Threats related to Xctdoor resume LNK lures

• Larva-26005 APT Campaign: Xctdoor and CRAT Backdoors Targeting South Korea (2020–2026)
• APT-C-60 Spear-Phishing Campaign Deploying SpyGlace Spyware (v3.1.12-3.1.14) via VHDX/LNK and Git (gcmd.exe) LOLBin Abuse
• Argamal RAT — Trojanized Hentai Games Deliver COM-Hijacking Implant and Downloader for Full Windows System Compromise

More from Andariel

• The Mac Malware of 2023: macOS Ransomware, Stealers, and DPRK/Iran-Linked APT Malware (Objective-See Annual Review)
• North Korean Threat Actors Operationalize AI Across Tradecraft (Jade/Coral/Jasper/Diamond/Onyx/Pearl/Sapphire/Emerald Sleet; ProcmacSteal)
• NSFOCUS Monthly APT Insights August 2026: Lazarus MISTPEN/ForestTiger/RelayShell Campaign with CVE-2026-68820, UAC-0099 LUNCHPOKE/BURNYBEAR/MATCHBOIL.V2, CVE-2026-42897 Exchange OWA Exploitation
• Operation FlashHole: Lazarus watering-hole and spear-phishing campaign abusing INISAFE CrossWeb EX against South Korean organizations
• Weekly threat digest (week ending 2026-06-07): PAN-OS GlobalProtect CVE-2026-0257 exploitation, React2Shell CVE-2025-55182 abuse by APT-C-26, and npm/state-actor campaigns
• Bitget Exchange Loses ~$351.6M (On-Chain: ~$356.9M) in Suspected North Korean (TraderTraitor) Backend Compromise and Authorization-Flow Abuse

Previous and next in malware

• Pony (Fareit/Siplog) Credential-Stealing Trojan and Downloader Previous report
• FishMonger (I-SOON / Winnti) Ports SprySOCKS Backdoor to Windows — WIN_DRV (RawWNPF Kernel Rootkit) & WIN_PLUS Variants Next report