Domestic APT Spear-Phishing Campaigns (May 2026) — LNK/HTA/CHM/JSE Loaders Deploying XenoRAT, Suspected Kimsuky — Threadlinqs Intelligence
As of 2026-07-11, Domestic APT Spear-Phishing Campaigns (May 2026) — LNK/HTA/CHM/JSE Loaders Deploying XenoRAT, Suspected Kimsuky is a high-severity malware threat attributed to Kimsuky (North Korea (DPRK)), tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 23 indicators of compromise.
Threat ID: TL-2026-1229 · Severity: HIGH · Status: ACTIVE · Category: MALWARE
Attribution: Kimsuky · North Korea (DPRK) · ESPIONAGE
ASEC documented eight distinct spear-phishing attack chains against South Korean targets in May 2026, using malicious LNK, HTA, CHM, and JSE files combined with PowerShell, curl.exe, certutil.exe, and
In May 2026, AhnLab Security Emergency response Center (ASEC) tracked eight parallel spear-phishing attack patterns (labeled Type A through Type H) against South Korean entities, continuing a long-running Kimsuky campaign lineage that has separately been observed abusing GitHub as C2 infrastructure against foreign embassies in Seoul. All eight chains begin with a malicious document-lure delivery mechanism (LNK, HTA, CHM, or JSE file) rather than exploitation of a software vulnerability, relying entirely on user execution (T1204.002) of a disguised file attached to or linked from a phishing email.
Type A uses an LNK file containing an obfuscated PowerShell command that reaches out to an external URL, retrieves an additional payload, and executes AutoIt-compiled malware, with persistence registered via Windows Task Scheduler. Type B distributes malicious HTA files staged on GitHub and Google Drive; curl.exe is copied to %TEMP% and used to fetch the HTA, which loads an infostealer, a keylogger, and a backdoor directly into memory to minimize on-disk artifacts. Type C embeds PowerShell inside an LNK file that builds a Base64-encoded blob in %TEMP%, retrieves a decoy document plus a malicious script hosted on GitHub, and ultimately deploys a XenoRAT variant that exfiltrates host/system information to the operator. Type D chains XML, JScript, and PowerShell components inside a single LNK, using a batch file and a compressed archive to unpack and execute a Python interpreter and Python scripts that give the operator remote command execution. Type E disguises the LNK as a resume or business document; VBS/BAT/PowerShell stages are registered through the task scheduler and the chain culminates in DLL side-loading that injects backdoor code into a legitimate signed process to evade detection. Type F uses CMD/PowerShell invoked from an LNK to download files and stage a private copy of curl.exe in %TEMP%, then installs Python packages and registers pythonw.exe in the task scheduler so a Python-based backdoor can receive and execute attacker commands on a recurring basis. Type G is JSE-based: the script drops a malicious DLL and a decoy document into %ProgramData% and abuses regsvr32.exe / regsvcs.exe (a Squiblydoo-style signed-binary proxy execution) to load the DLL into memory for credential/user-information theft and backdoor functionality. Type H abuses a CHM (compiled HTML Help) file whose embedded HTML runs a PowerShell command that generates a Base64-encoded VBScript; the VBScript is decoded with certutil.exe (living-off-the-land binary abuse of a certificate-utility tool for encoding/decoding, T1140) and executed via wscript.exe, after which the implant calls out to an external C2 server for further script delivery.
Across the eight chains the toolset overlaps heavily with previously documented Kimsuky (aka Black Banshee, Velvet Chollima, Emerald Sleet, THALLIUM, APT43, TA427, Springtail, Earth Kumiho, PatheticSlug) tradecraft: LNK files disguised with document icons and double extensions, PowerShell-based droppers pulling staged payloads from GitHub repositories and Google Drive links, Task Scheduler persistence, DLL side-loading into legitimate signed processes, and final-stage RATs (XenoRAT, AutoIt malware, Python backdoors, infostealers, keyloggers, and the previously catalogued Kimsuky families Mudsdoor and MeshCmd) providing keystroke logging, screen capture, file exfiltration, and remote command execution. This lineage is consistent with a broader March–July 2025 Kimsuky campaign against diplomatic missions in South Korea that used password-protected ZIP archives containing LNK files disguised as PDFs (e.g. "Urgent Letter from the Ambassador.pdf.lnk"), obfuscated PowerShell downloading Base64 payloads from GitHub, and a XenoRAT variant obfuscated with ConfuserEx/Confuser Core 1.6.0 providing full remote system control (keylogging, screenshot capture, webcam access, remote shell). No CVE is exploited in this campaign; the in
Target sectors: government administration, diplomatic missions, research academia, private enterprise
Target regions: south korea, East Asia
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 23 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
Community OSINT corroboration
3 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.
MALWARE, HIGH, threat intelligence, cybersecurity, T1566, T1566.001, T1566.002, T1204.002, T1059.001, T1059.003, T1059.005, T1059.007, T1059.006, T1047