# Xctdoor Backdoor Delivered via Resume-Themed LNK Files, PowerShell/VBScript Loaders, and ProximityUxHost.exe DLL Side-Loading (Andariel)

> An active North Korean-linked (Andariel) campaign delivers the Go-based Xctdoor backdoor through malicious resume-themed LNK files. PowerShell, VBScript, and batch loaders stage components in public user directories, then side-load a malicious ProximityCommon.dll via the legitimate signed ProximityUxHost.exe to launch the settings.dat payload, which injects into trusted Windows processes and beacons over HTTP. Persistence uses a Task Scheduler entry named 'Office365' that runs a VBScript every ten minutes plus a startup-folder shortcut.

- **Published:** 2026-06-19T00:00:00Z
- **Last reviewed:** 2026-06-19T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0869
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-xctdoor-resume-lnk-lures-tl-2026-0869.webp?v=b57691b4 (Threadlinqs threat intel: Xctdoor Resume LNK Side-Load Chain: Detection & IOCs (TL-2026-0869) — High severity, 24 IOCs, 9 detection rules.)
- **ID:** TL-2026-0869
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** Andariel (North Korea)
- **Detections:** 9 (1 shown free below) · **IOCs:** 24 (3 shown free below)

## Description

ASEC (AhnLab Security Intelligence Center) and corroborating reporting describe an active social-engineering malware campaign targeting corporate recruitment, HR, sales, and customer-support teams with malicious LNK files masquerading as job resumes (naming pattern '(RESUME)Company_JobTitle***.LNK'). Opening the shortcut displays a decoy resume document while hidden batch, PowerShell (.ps1), and VBScript (.vbs) loaders with randomized names execute from C:\Users\Public\Videos\ and C:\Users\Public\Pictures\. A second-stage PowerShell script (p2.ps1) retrieves and Base64-decodes additional components, including the legitimate, signed ProximityUxHost.exe, a malicious ProximityCommon.dll, and the encrypted settings.dat payload.

The attack abuses DLL side-loading (T1574.002): launching the trusted ProximityUxHost.exe causes it to load the adversary's ProximityCommon.dll from the same directory, executing malicious code under the cover of a signed Microsoft binary. The DLL reconstructs and loads settings.dat, the Xctdoor backdoor. Xctdoor (a Go-based evolution tied to the older HotCroissant family and delivered by the XcLoader injector that was rewritten from C to Go) injects itself into legitimate processes such as taskhost.exe, taskhostex.exe, taskhostw.exe, and explorer.exe via process injection/hollowing, then establishes HTTP command-and-control. Outbound traffic is obfuscated using the Mersenne Twister (mt19937) pseudo-random generator combined with Base64 encoding. Backdoor capabilities include screenshot capture, keylogging, clipboard theft, drive and system information collection (username, computer name, PID), arbitrary command execution, and secondary payload delivery.

Persistence is multi-layered: a scheduled task named 'Office365' (masquerading as a Microsoft service) executes a VBScript every ten minutes, surviving reboots and security-tool termination, and a startup shortcut (Microsoft.Bing.lnk; the Andariel ERP/web-server variants used MicrosoftEdge.lnk with a copy at %LOCALAPPDATA%\Packages\Microsoft.MicrosoftEdge.Current_8wekyb3d8bbwe\Settings\roaming.dat) re-launches the implant at logon. The Andariel cluster (a subgroup of the Lazarus Group, North Korea) has used Xctdoor against South Korean defense and manufacturing organizations, historically pivoting through ERP solutions and Internet-facing IIS web servers; the C2 195.50.242.110:8080 traces to the HotCroissant predecessor and hxxp://beebeep[.]info/index.php to Xctdoor operations.

## MITRE ATT&CK

- T1566 Phishing
- T1204 User Execution
- T1059 Command and Scripting Interpreter
- T1053 Scheduled Task/Job
- T1547 Boot or Logon Autostart Execution
- T1574 Hijack Execution Flow
- T1055 Process Injection
- T1140 Deobfuscate/Decode Files or Information
- T1036 Masquerading
- T1082 System Information Discovery
- T1033 System Owner/User Discovery
- T1113 Screen Capture
- T1056 Input Capture
- T1115 Clipboard Data
- T1071 Application Layer Protocol
- T1132 Data Encoding
- T1105 Ingress Tool Transfer
- T1041 Exfiltration Over C2 Channel

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Xctdoor HTTP C2 Beacon — Injected Trusted Process to Non-Microsoft Host (C2/Lateral)** (`TL-2026-0869-SPL-003`)

Detects Xctdoor command-and-control: a normally non-networking host process (taskhostw.exe, taskhost.exe, taskhostex.exe, explorer.exe) — the process-injection/hollowing targets — initiating outbound HTTP to a non-Microsoft destination, including the known C2 indicators 195.50.242.110:8080 and beebeep.info/index.php. Xctdoor obfuscates the beacon body with the mt19937 PRNG keystream plus Base64 at a fixed interval+jitter. Flags both the known IOCs and the anomalous trusted-process-as-HTTP-client behavior.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1071.001, T1132.001, T1105, T1041, T1055.012
- **Data sources:** sysmon, microsoft_defender_for_endpoint, zeek, firewall, proxy
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=3
| where match(Image, "(?i)\\\\(taskhostw|taskhost|taskhostex|explorer)\.exe$")
| where Initiated="true" AND (DestinationPort=80 OR DestinationPort=8080 OR DestinationPort=443)
| eval known_ioc=if(DestinationIp="195.50.242.110" OR like(DestinationHostname,"%beebeep.info%"), "known_c2", "anomalous_trusted_proc_http")
| where NOT match(DestinationHostname, "(?i)(microsoft|windows|msftncsi|office365|windowsupdate)\.com$")
| stats count min(_time) as firstTime max(_time) as lastTime values(DestinationIp) as dest_ip values(DestinationHostname) as dest_host values(DestinationPort) as dest_port by host, Image, known_ioc
| convert ctime(firstTime) ctime(lastTime)
| sort - count
```

### Microsoft KQL

```kql
DeviceNetworkEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName in~ ("taskhostw.exe","taskhost.exe","taskhostex.exe","explorer.exe")
| where RemotePort in (80, 8080, 443)
| where RemoteIP == "195.50.242.110" or RemoteUrl has "beebeep.info"
    or (isnotempty(RemoteUrl) and RemoteUrl !has "microsoft.com" and RemoteUrl !has "windows.com" and RemoteUrl !has "msftncsi.com")
| extend Verdict = iff(RemoteIP == "195.50.242.110" or RemoteUrl has "beebeep.info", "known_c2", "anomalous_trusted_proc_http")
| project Timestamp, DeviceName, InitiatingProcessFileName, RemoteIP, RemoteUrl, RemotePort, Verdict
| order by Timestamp desc
```

### Sigma

```yaml
title: Xctdoor C2 Beacon From Injected Trusted Process
id: 4d9a1c63-7e22-4b08-9a51-3b0e6f8c2d03
status: experimental
description: Detects taskhostw.exe/explorer.exe and related processes making outbound HTTP to the Xctdoor C2 (195.50.242.110, beebeep.info) or to any non-Microsoft host shortly after DLL side-load, indicating process injection and C2 beaconing.
references:
    - https://asec.ahnlab.com/en/74835/
    - https://cyberpress.org/resume-lures-deliver-xctdoor/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/06/19
tags:
    - attack.command_and_control
    - attack.t1071.001
    - attack.t1132.001
    - attack.t1105
    - attack.exfiltration
    - attack.t1041
logsource:
    product: windows
    category: network_connection
detection:
    selection_proc:
        Image|endswith:
            - '\taskhostw.exe'
            - '\taskhost.exe'
            - '\taskhostex.exe'
            - '\explorer.exe'
        Initiated: 'true'
    selection_ioc:
        DestinationIp: '195.50.242.110'
        DestinationHostname|contains: 'beebeep.info'
    condition: selection_proc and selection_ioc
falsepositives:
    - explorer.exe shell-opened URLs from genuine user browsing (validate process-injection context and destination)
level: critical
```

**Known false positives:**

- explorer.exe opening user-clicked URLs in a default handler
- Legitimate task host telemetry to Microsoft endpoints (excluded by the host filter)

**Tuning notes:** Feed the known C2 IOCs (195.50.242.110, beebeep.info) into a threat-intel lookup for immediate high-confidence alerting. For the anomalous-process branch, baseline normal explorer.exe destinations per environment and exclude corporate proxies. Correlate with SPL-001/SPL-002 and image_load of ProximityCommon.dll within the prior hour to raise confidence.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- ProximityUxHost DLL Side-Loading of Non-Default [indicator] (Exploitation) (locked: unlock with TL Creds)
- Xctdoor Process Injection into Trusted Task Host Processes (Post-Exploitation) (locked: unlock with TL Creds)
- Xctdoor mt19937+Base64 HTTP C2 Beacon to Known Indicators (C2/Lateral) (locked: unlock with TL Creds)
- Xctdoor Payload Staging — [indicator]/[indicator]/ProximityUxHost Dropped to Public Dirs (Exploitation) (locked: unlock with TL Creds)
- Resume-Themed LNK Spawning Script Interpreters / curl Staging (Exploitation Initial Access) (locked: unlock with TL Creds)
- Xctdoor Startup-Folder Shortcut Persistence — [indicator] / [indicator] (Post-Exploitation) (locked: unlock with TL Creds)
- Xctdoor Script Loader Execution from Public Videos/Pictures (Exploitation) (locked: unlock with TL Creds)
- Office365-Named Scheduled Task Running WScript from Public Dir (Post-Exploitation Persistence) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 24)

Defanged, TLP:CLEAR.

- IP address: `195.50.242[.]110`
- Domain: `beebeep[.]info`
- File hash: `ad96a8f22faab8b9c361cfccc381cd28`

Full set of 24 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Hackers Abuse PowerShell to Deliver Xctdoor Backdoor](https://cybersecuritynews.com/hackers-abuse-powershell-deliver-xctdoor-backdoor/)
- [Malicious LNK Files Disguised as Job Resumes Target Corporate Employees](https://gbhackers.com/lnk-files-disguised-as-job-resumes/)
- [Hackers Use Resume-Themed LNK Files to Deploy Xctdoor Backdoor via DLL Side Loading](https://cyberpress.org/resume-lures-deliver-xctdoor/)
- [Xctdoor Malware Used in Attacks Against Korean Companies (Andariel) - ASEC](https://asec.ahnlab.com/en/74835/)
- [The Xctdoor Backdoor Ecosystem: Memory-Resident Go Architectures and HR-Vector Weaponization](https://www.brinztech.com/breach-alerts/advanced-threat-engineering-briefing-memory-resident-go-architectures-cross-process-injection-loops-and-the-strategic-weaponization-of-hr-vectors-the-xctdoor-backdoor-ecosystem)
- [MITRE ATT&CK Group: Andariel (G0138)](https://attack.mitre.org/groups/G0138/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0869