Xctdoor Backdoor Delivered via Resume-Themed LNK Files, PowerShell/VBScript Loaders, and ProximityUxHost.exe DLL Side-Loading (Andariel)
Xctdoor Backdoor Delivered via Resume-Themed LNK Files (TL-2026-0869), also tracked as Xctdoor resume-LNK campaign, is a high-severity malware campaign, first published 2026-06-19. It is attributed to Andariel (North Korea) with medium confidence, affects Microsoft Windows, maps to 18 MITRE ATT&CK techniques (T1033, T1036, T1041), and is covered by 9 detection rules and 24 indicators of compromise.
Key facts for TL-2026-0869
- Threat ID
- TL-2026-0869
- Also known as
- Xctdoor resume-LNK campaign, Operation Resume Lure
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- 2026-06-19
- Last reviewed
- 2026-06-19
- Attribution
- Andariel
- Attribution confidence
- MEDIUM
- Nation-state nexus
- North Korea
- Motivation
- ESPIONAGE
- Target sectors
- defense, manufacturing, human resources, recruitment, sales, customer support
- Target regions
- South Korea, Asia
- Detection rules
- 9
- Indicators of compromise
- 24
Malware and tooling in Xctdoor Backdoor Delivered via Resume-Themed LNK Files
Malware and tooling: Xctdoor, XcLoader
An active North Korean-linked (Andariel) campaign delivers the Go-based Xctdoor backdoor through malicious resume-themed LNK files. PowerShell, VBScript, and batch loaders stage components in public user directories, then side-load a malicious ProximityCommon.dll via the legitimate signed ProximityUxHost.exe to launch the settings.dat payload, which injects into trusted Windows processes and beacons over HTTP. Persistence uses a Task Scheduler entry named 'Office365' that runs a VBScript every ten minutes plus a startup-folder shortcut.
How Xctdoor Backdoor Delivered via Resume-Themed LNK Files works
ASEC (AhnLab Security Intelligence Center) and corroborating reporting describe an active social-engineering malware campaign targeting corporate recruitment, HR, sales, and customer-support teams with malicious LNK files masquerading as job resumes (naming pattern '(RESUME)Company_JobTitle***.LNK'). Opening the shortcut displays a decoy resume document while hidden batch, PowerShell (.ps1), and VBScript (.vbs) loaders with randomized names execute from C:\Users\Public\Videos\ and C:\Users\Public\Pictures\. A second-stage PowerShell script (p2.ps1) retrieves and Base64-decodes additional components, including the legitimate, signed ProximityUxHost.exe, a malicious ProximityCommon.dll, and the encrypted settings.dat payload.
The attack abuses DLL side-loading (T1574.002): launching the trusted ProximityUxHost.exe causes it to load the adversary's ProximityCommon.dll from the same directory, executing malicious code under the cover of a signed Microsoft binary. The DLL reconstructs and loads settings.dat, the Xctdoor backdoor. Xctdoor (a Go-based evolution tied to the older HotCroissant family and delivered by the XcLoader injector that was rewritten from C to Go) injects itself into legitimate processes such as taskhost.exe, taskhostex.exe, taskhostw.exe, and explorer.exe via process injection/hollowing, then establishes HTTP command-and-control. Outbound traffic is obfuscated using the Mersenne Twister (mt19937) pseudo-random generator combined with Base64 encoding. Backdoor capabilities include screenshot capture, keylogging, clipboard theft, drive and system information collection (username, computer name, PID), arbitrary command execution, and secondary payload delivery.
Persistence is multi-layered: a scheduled task named 'Office365' (masquerading as a Microsoft service) executes a VBScript every ten minutes, surviving reboots and security-tool termination, and a startup shortcut (Microsoft.Bing.lnk; the Andariel ERP/web-server variants used MicrosoftEdge.lnk with a copy at %LOCALAPPDATA%\Packages\Microsoft.MicrosoftEdge.Current_8wekyb3d8bbwe\Settings\roaming.dat) re-launches the implant at logon. The Andariel cluster (a subgroup of the Lazarus Group, North Korea) has used Xctdoor against South Korean defense and manufacturing organizations, historically pivoting through ERP solutions and Internet-facing IIS web servers; the C2 195.50.242.110:8080 traces to the HotCroissant predecessor and hxxp://beebeep[.]info/index.php to Xctdoor operations.
MITRE ATT&CK techniques used in TL-2026-0869
Discovery
T1033 System Owner/User Discovery; T1082 System Information Discovery
Defense Evasion
T1036 Masquerading; T1055 Process Injection; T1140 Deobfuscate/Decode Files or Information; T1574 Hijack Execution Flow
Exfiltration
T1041 Exfiltration Over C2 Channel
Persistence
T1053 Scheduled Task/Job; T1547 Boot or Logon Autostart Execution
Collection
T1056 Input Capture; T1113 Screen Capture; T1115 Clipboard Data
Execution
T1059 Command and Scripting Interpreter; T1204 User Execution
Command and Control
T1071 Application Layer Protocol; T1105 Ingress Tool Transfer; T1132 Data Encoding
Initial Access
Affected products and versions in Xctdoor Backdoor Delivered via Resume-Themed LNK Files
- Microsoft — Windows
Vulnerable versions: 10; 11; Server
Remediation for Xctdoor Backdoor Delivered via Resume-Themed LNK Files
Immediate actions
- Hunt for and delete the 'Office365' scheduled task that launches a VBScript every 10 minutes from user-writable paths
- Quarantine ProximityCommon.dll, settings.dat, p2.ps1, Microsoft.Bing.lnk, MicrosoftEdge.lnk, and roaming.dat from C:\Users\Public\Videos\, C:\Users\Public\Pictures\, Startup folders, and the Microsoft.MicrosoftEdge package Settings path
- Block C2 indicators 195.50.242.110 and beebeep.info at the perimeter/DNS
- Isolate hosts showing ProximityUxHost.exe loading a non-default ProximityCommon.dll or injecting into taskhostw.exe/explorer.exe
Workarounds
- Disable Windows Script Host (wscript/cscript) where not required to break VBScript persistence
- Configure scheduled-task creation auditing (Event ID 4698) and alert on tasks named after Microsoft products
Longer-term hardening
- Deploy EDR with behavioral DLL-side-loading and process-injection detection
- Restrict execution from C:\Users\Public\ and other world-writable directories via WDAC/AppLocker
- Enforce LNK-attachment filtering and user awareness for resume/HR-themed lures
- Enable PowerShell script-block and module logging and monitor curl/Base64 staging behavior
Timeline of Xctdoor Backdoor Delivered via Resume-Themed LNK Files
- Rifdoor, the earliest backdoor in the Andariel lineage that later evolved into HotCroissant and Xctdoor, first discovered in the wild.
- Korean ERP solution abused: a malicious routine inserted into ClientUpdater.exe distributes the HotCroissant backdoor (Rifdoor variant). C2 195.50.242.110:8080 is tied to this North Korean lineage.
- AhnLab detection signatures dated for the Rifdoor and Andaridown variants, marking continued tracking of the Andariel backdoor lineage that precedes Xctdoor.
- US CISA and VMware Carbon Black publicly disclosed analysis of the HotCroissant backdoor and its connection to Lazarus/Andariel operations.
- Andariel compromises Internet-facing Windows IIS 8.5 web servers in South Korea, installing the Go-language XcLoader injector on manufacturing-sector systems to deploy Xctdoor.
- Andariel conducts ERP-solution-based attacks against South Korean defense and manufacturing firms, deploying Xctdoor via a modified ClientUpdater.exe; the 'XctMain' development keyword is identified in the malware.
- ASEC (AhnLab) publishes a comprehensive analysis of the Xctdoor backdoor and the XcLoader injector (rewritten from C to Go), attributing the campaign to Andariel.
- Active resume-themed LNK campaign delivering Xctdoor via PowerShell/VBScript/batch loaders and ProximityUxHost.exe DLL side-loading reported, targeting recruitment, HR, sales, and customer-support teams; persistence via an 'Office365' scheduled task running a VBScript every ten minutes.
Sources cited for Xctdoor Backdoor Delivered via Resume-Themed LNK Files
- Hackers Abuse PowerShell to Deliver Xctdoor Backdoor
- Malicious LNK Files Disguised as Job Resumes Target Corporate Employees
- Hackers Use Resume-Themed LNK Files to Deploy Xctdoor Backdoor via DLL Side Loading
- Xctdoor Malware Used in Attacks Against Korean Companies (Andariel) - ASEC
- The Xctdoor Backdoor Ecosystem: Memory-Resident Go Architectures and HR-Vector Weaponization
- MITRE ATT&CK Group: Andariel (G0138)
Threats related to Xctdoor Backdoor Delivered via Resume-Themed LNK Files
- Larva-26005 APT Campaign: Xctdoor and CRAT Backdoors Targeting South Korea (2020–2026)
- APT-C-60 2026 Campaign: SpyGlace Backdoor Delivered via LNK Files and Abused Legitimate Services
- APT-C-60 Spear-Phishing Campaign Deploying SpyGlace Spyware (v3.1.12-3.1.14) via VHDX/LNK and Git (gcmd.exe) LOLBin Abuse
- Argamal RAT — Trojanized Hentai Games Deliver COM-Hijacking Implant and Downloader for Full Windows System Compromise
Detection coverage for TL-2026-0869
As of 2026-06-19, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0869 across Splunk SPL, Microsoft KQL and Sigma, covering 24 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.