Domestic APT Spear-Phishing Campaigns (May 2026) — LNK/HTA/CHM/JSE Loaders Deploying XenoRAT, Suspected Kimsuky
Domestic APT Spear-Phishing Campaigns (May 2026) (TL-2026-1229), also tracked as May 2026 Korea APT Attack Trend Report, is a high-severity malware campaign, first published 2026-07-11. It is attributed to Kimsuky (North Korea) with medium confidence, affects Microsoft Windows (LNK/HTA/CHM/WSH/PowerShell subsystems), maps to 32 MITRE ATT&CK techniques (T1027, T1033, T1036.007), and is covered by 9 detection rules and 23 indicators of compromise.
Key facts for TL-2026-1229
- Threat ID
- TL-2026-1229
- Also known as
- May 2026 Korea APT Attack Trend Report, ASEC 94270/94271
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- 2026-07-11
- Last reviewed
- 2026-07-11
- Attribution
- Kimsuky
- Attribution confidence
- MEDIUM
- Nation-state nexus
- North Korea
- Motivation
- ESPIONAGE
- Target sectors
- government administration, diplomatic missions, research academia, private enterprise
- Target regions
- south korea, East Asia
- Detection rules
- 9
- Indicators of compromise
- 23
Malware and tooling in Domestic APT Spear-Phishing Campaigns (May 2026)
Malware and tooling: AutoIt malware, MeshCmd, Mudsdoor, Python backdoor, XenoRAT
ASEC documented eight distinct spear-phishing attack chains against South Korean targets in May 2026, using malicious LNK, HTA, CHM, and JSE files combined with PowerShell, curl.exe, certutil.exe, and regsvr32.exe abuse to download AutoIt malware, XenoRAT, Python-based backdoors, infostealers, and keyloggers. Activity is tagged as suspected Kimsuky (DPRK-aligned).
How Domestic APT Spear-Phishing Campaigns (May 2026) works
In May 2026, AhnLab Security Emergency response Center (ASEC) tracked eight parallel spear-phishing attack patterns (labeled Type A through Type H) against South Korean entities, continuing a long-running Kimsuky campaign lineage that has separately been observed abusing GitHub as C2 infrastructure against foreign embassies in Seoul. All eight chains begin with a malicious document-lure delivery mechanism (LNK, HTA, CHM, or JSE file) rather than exploitation of a software vulnerability, relying entirely on user execution (T1204.002) of a disguised file attached to or linked from a phishing email.
Type A uses an LNK file containing an obfuscated PowerShell command that reaches out to an external URL, retrieves an additional payload, and executes AutoIt-compiled malware, with persistence registered via Windows Task Scheduler. Type B distributes malicious HTA files staged on GitHub and Google Drive; curl.exe is copied to %TEMP% and used to fetch the HTA, which loads an infostealer, a keylogger, and a backdoor directly into memory to minimize on-disk artifacts. Type C embeds PowerShell inside an LNK file that builds a Base64-encoded blob in %TEMP%, retrieves a decoy document plus a malicious script hosted on GitHub, and ultimately deploys a XenoRAT variant that exfiltrates host/system information to the operator. Type D chains XML, JScript, and PowerShell components inside a single LNK, using a batch file and a compressed archive to unpack and execute a Python interpreter and Python scripts that give the operator remote command execution. Type E disguises the LNK as a resume or business document; VBS/BAT/PowerShell stages are registered through the task scheduler and the chain culminates in DLL side-loading that injects backdoor code into a legitimate signed process to evade detection. Type F uses CMD/PowerShell invoked from an LNK to download files and stage a private copy of curl.exe in %TEMP%, then installs Python packages and registers pythonw.exe in the task scheduler so a Python-based backdoor can receive and execute attacker commands on a recurring basis. Type G is JSE-based: the script drops a malicious DLL and a decoy document into %ProgramData% and abuses regsvr32.exe / regsvcs.exe (a Squiblydoo-style signed-binary proxy execution) to load the DLL into memory for credential/user-information theft and backdoor functionality. Type H abuses a CHM (compiled HTML Help) file whose embedded HTML runs a PowerShell command that generates a Base64-encoded VBScript; the VBScript is decoded with certutil.exe (living-off-the-land binary abuse of a certificate-utility tool for encoding/decoding, T1140) and executed via wscript.exe, after which the implant calls out to an external C2 server for further script delivery.
Across the eight chains the toolset overlaps heavily with previously documented Kimsuky (aka Black Banshee, Velvet Chollima, Emerald Sleet, THALLIUM, APT43, TA427, Springtail, Earth Kumiho, PatheticSlug) tradecraft: LNK files disguised with document icons and double extensions, PowerShell-based droppers pulling staged payloads from GitHub repositories and Google Drive links, Task Scheduler persistence, DLL side-loading into legitimate signed processes, and final-stage RATs (XenoRAT, AutoIt malware, Python backdoors, infostealers, keyloggers, and the previously catalogued Kimsuky families Mudsdoor and MeshCmd) providing keystroke logging, screen capture, file exfiltration, and remote command execution. This lineage is consistent with a broader March–July 2025 Kimsuky campaign against diplomatic missions in South Korea that used password-protected ZIP archives containing LNK files disguised as PDFs (e.g. "Urgent Letter from the Ambassador.pdf.lnk"), obfuscated PowerShell downloading Base64 payloads from GitHub, and a XenoRAT variant obfuscated with ConfuserEx/Confuser Core 1.6.0 providing full remote system control (keylogging, screenshot capture, webcam access, remote shell). No CVE is exploited in this campaign; the initial access vector is entirely social-engineering and user-execution based.
MITRE ATT&CK techniques used in TL-2026-1229
Defense Evasion
T1027 Obfuscated Files or Information; T1036.007 Double File Extension; T1055 Process Injection; T1140 Deobfuscate/Decode Files or Information; T1218.001 Compiled HTML File; T1218.005 Mshta; T1218.010 Regsvr32
Discovery
T1033 System Owner/User Discovery; T1082 System Information Discovery
Exfiltration
T1041 Exfiltration Over C2 Channel; T1567.002 Exfiltration to Cloud Storage
Execution
T1047 Windows Management Instrumentation; T1059.001 PowerShell; T1059.003 Windows Command Shell; T1059.005 Visual Basic; T1059.006 Python; T1059.007 JavaScript; T1204.002 Malicious File
Persistence
T1053.005 Scheduled Task; T1547.001 Registry Run Keys / Startup Folder
Privilege Escalation
Credential Access
Command and Control
T1071.001 Web Protocols; T1102.002 Bidirectional Communication; T1105 Ingress Tool Transfer; T1219 Remote Access Tools
Collection
T1113 Screen Capture; T1125 Video Capture; T1560 Archive Collected Data
Initial Access
T1566 Phishing; T1566.001 Spearphishing Attachment; T1566.002 Spearphishing Link
stealth
Affected products and versions in Domestic APT Spear-Phishing Campaigns (May 2026)
- Microsoft — Windows (LNK/HTA/CHM/WSH/PowerShell subsystems)
Vulnerable versions: all supported Windows desktop/server releases
Remediation for Domestic APT Spear-Phishing Campaigns (May 2026)
Immediate actions
- Block execution of LNK, HTA, CHM, and JSE attachments/downloads at the email gateway and endpoint
- Block outbound traffic to the listed C2 domains/URLs (newtech.dkcreatech.com:57877, aplore.kesug.com, univercity.library.boxathome.net, update.nstlog.store) at perimeter and DNS layers
- Hunt for the published MD5 hashes across EDR/AV telemetry and quarantine matches
- Restrict/monitor use of curl.exe, certutil.exe, regsvr32.exe, regsvcs.exe, and wscript.exe launched from user-writable temp/ProgramData paths
- Alert on GitHub raw-content and Google Drive download URLs fetched by scripting hosts (powershell.exe, wscript.exe, mshta.exe)
Workarounds
- Disable Windows Script Host organization-wide where not operationally required
- Configure Windows Explorer/Outlook to block execution of .lnk/.hta/.chm/.jse attachments by default
Longer-term hardening
- Deploy application control (AppLocker/WDAC) to restrict LNK/HTA/CHM execution from mail-client and browser download paths
- Disable or tightly restrict Windows Script Host (wscript.exe/cscript.exe) execution for standard users
- Enforce PowerShell Constrained Language Mode + Script Block Logging across the fleet
- Deploy EDR with behavioral detection tuned for DLL side-loading and LOLBin proxy execution (regsvr32/regsvcs/certutil)
- User awareness training targeting resume/document-themed spear-phishing lures common to Kimsuky operations
Timeline of Domestic APT Spear-Phishing Campaigns (May 2026)
- Related Kimsuky campaign against foreign embassies in South Korea begins (March–July 2025), using LNK-in-ZIP lures and GitHub-hosted C2/payload delivery.
- Fortinet publishes 'DPRK-Related Campaigns with LNK and GitHub C2', documenting the Kimsuky LNK-loader-to-GitHub-C2 tradecraft later mirrored in the May 2026 domestic chains.
- Trellix publishes 'DPRK-linked GitHub C2 Espionage Campaign' research detailing the group's use of GitHub repositories as bidirectional command-and-control infrastructure.
- Security researchers (Trellix, Fortinet, BleepingComputer, Cyber Security News) publicly report the Kimsuky GitHub C2 espionage campaign against embassies, detailing a ConfuserEx/Confuser Core 1.6.0-packed XenoRAT variant with full remote-control (keylogging, screenshot, webcam) capability.
- ASEC's tracked May 2026 activity window for the eight domestic APT spear-phishing attack chains (Types A–H) begins.
- May 2026 activity window closes; ASEC compiles observed LNK/HTA/CHM/JSE chains, associated MD5 hashes, and C2 URLs/domains for the monthly APT trend report.
- ASEC publishes the April 2026 APT trend report (93831), the precursor edition covering the preceding month's domestic APT activity.
- ASEC report discloses the campaign's full IOC set — loader hashes, GitHub/Google Drive staging links, and newtech.dkcreatech.com/aplore.kesug.com/univercity.library.boxathome.net/update.nstlog.store C2 infrastructure — enabling perimeter blocking and EDR retro-hunting.
- ASEC publishes report 94270 (Korean) / 94271 (English) detailing the eight May 2026 attack patterns (Types A–H), five MD5 hashes, five C2/staging URLs, two C2 FQDNs, and suspected Kimsuky tagging.
- Threadlinqs RESEARCH phase analyzes and documents the campaign, cross-referencing prior Kimsuky/XenoRAT reporting, MITRE ATT&CK group data (G0094), and BeaconBeagle infrastructure correlation checks.
Sources cited for Domestic APT Spear-Phishing Campaigns (May 2026)
- ASEC 분석 리포트 (94270) — 국내 APT 공격 그룹 동향 (2026년 5월)
- May 2026 Threat Trend Report on APT Attacks (South Korea) - ASEC
- April 2026 Threat Trend Report on APT Attacks (South Korea) - ASEC
- North Korean Kimsuky Hackers Leveraged GitHub to Attack Foreign Embassies with XenoRAT Malware
- XenoRAT malware campaign hits multiple embassies in South Korea
- DPRK-linked GitHub C2 Espionage Campaign
- DPRK-Related Campaigns with LNK and GitHub C2
- MITRE ATT&CK — Kimsuky (G0094)
Threats related to Domestic APT Spear-Phishing Campaigns (May 2026)
- Larva-26005 APT Campaign: Xctdoor and CRAT Backdoors Targeting South Korea (2020–2026)
- Kimsuky CHM Dropper / VBScript Stager / PowerShell Keylogger Kill Chain Recovered from Live C2 (api_reference.chm, check.nid-log.com)
- Kimsuky (Velvet Chollima) PebbleDash Cluster — HelloDoor, httpMalice, httpTroy/MemLoad & VS Code Remote Tunnel Abuse Against South Korea
- Kimsuky Group Impersonates Diplomats to Deploy PebbleDash Backdoor and PrxClient Proxy (CVE-less LNK Campaign)
- ASEC April 2026 APT Trend Report (South Korea) — Kimsuky-Aligned LNK/PowerShell/AutoIt Spear-Phishing with PubNub C2, GitHub-Hosted HTA & XenoRAT (5 Infection Types)
- July 2026 Domestic APT Attack Trends (South Korea): LNK-Based Spear Phishing Delivering XenoRAT and Info-Stealers
Detection coverage for TL-2026-1229
As of 2026-07-11, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1229 across Splunk SPL, Microsoft KQL and Sigma, covering 23 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.
Community OSINT corroboration for TL-2026-1229
3 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.