# Domestic APT Spear-Phishing Campaigns (May 2026) — LNK/HTA/CHM/JSE Loaders Deploying XenoRAT, Suspected Kimsuky

> ASEC documented eight distinct spear-phishing attack chains against South Korean targets in May 2026, using malicious LNK, HTA, CHM, and JSE files combined with PowerShell, curl.exe, certutil.exe, and regsvr32.exe abuse to download AutoIt malware, XenoRAT, Python-based backdoors, infostealers, and keyloggers. Activity is tagged as suspected Kimsuky (DPRK-aligned).

- **Published:** 2026-07-11T00:00:00Z
- **Last reviewed:** 2026-07-11T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1229
- **ID:** TL-2026-1229
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** Kimsuky (North Korea)
- **Detections:** 9 · **IOCs:** 23 (full data via the Threadlinqs MCP server — Purple tier)

## Description

In May 2026, AhnLab Security Emergency response Center (ASEC) tracked eight parallel spear-phishing attack patterns (labeled Type A through Type H) against South Korean entities, continuing a long-running Kimsuky campaign lineage that has separately been observed abusing GitHub as C2 infrastructure against foreign embassies in Seoul. All eight chains begin with a malicious document-lure delivery mechanism (LNK, HTA, CHM, or JSE file) rather than exploitation of a software vulnerability, relying entirely on user execution (T1204.002) of a disguised file attached to or linked from a phishing email.

Type A uses an LNK file containing an obfuscated PowerShell command that reaches out to an external URL, retrieves an additional payload, and executes AutoIt-compiled malware, with persistence registered via Windows Task Scheduler. Type B distributes malicious HTA files staged on GitHub and Google Drive; curl.exe is copied to %TEMP% and used to fetch the HTA, which loads an infostealer, a keylogger, and a backdoor directly into memory to minimize on-disk artifacts. Type C embeds PowerShell inside an LNK file that builds a Base64-encoded blob in %TEMP%, retrieves a decoy document plus a malicious script hosted on GitHub, and ultimately deploys a XenoRAT variant that exfiltrates host/system information to the operator. Type D chains XML, JScript, and PowerShell components inside a single LNK, using a batch file and a compressed archive to unpack and execute a Python interpreter and Python scripts that give the operator remote command execution. Type E disguises the LNK as a resume or business document; VBS/BAT/PowerShell stages are registered through the task scheduler and the chain culminates in DLL side-loading that injects backdoor code into a legitimate signed process to evade detection. Type F uses CMD/PowerShell invoked from an LNK to download files and stage a private copy of curl.exe in %TEMP%, then installs Python packages and registers pythonw.exe in the task scheduler so a Python-based backdoor can receive and execute attacker commands on a recurring basis. Type G is JSE-based: the script drops a malicious DLL and a decoy document into %ProgramData% and abuses regsvr32.exe / regsvcs.exe (a Squiblydoo-style signed-binary proxy execution) to load the DLL into memory for credential/user-information theft and backdoor functionality. Type H abuses a CHM (compiled HTML Help) file whose embedded HTML runs a PowerShell command that generates a Base64-encoded VBScript; the VBScript is decoded with certutil.exe (living-off-the-land binary abuse of a certificate-utility tool for encoding/decoding, T1140) and executed via wscript.exe, after which the implant calls out to an external C2 server for further script delivery.

Across the eight chains the toolset overlaps heavily with previously documented Kimsuky (aka Black Banshee, Velvet Chollima, Emerald Sleet, THALLIUM, APT43, TA427, Springtail, Earth Kumiho, PatheticSlug) tradecraft: LNK files disguised with document icons and double extensions, PowerShell-based droppers pulling staged payloads from GitHub repositories and Google Drive links, Task Scheduler persistence, DLL side-loading into legitimate signed processes, and final-stage RATs (XenoRAT, AutoIt malware, Python backdoors, infostealers, keyloggers, and the previously catalogued Kimsuky families Mudsdoor and MeshCmd) providing keystroke logging, screen capture, file exfiltration, and remote command execution. This lineage is consistent with a broader March–July 2025 Kimsuky campaign against diplomatic missions in South Korea that used password-protected ZIP archives containing LNK files disguised as PDFs (e.g. "Urgent Letter from the Ambassador.pdf.lnk"), obfuscated PowerShell downloading Base64 payloads from GitHub, and a XenoRAT variant obfuscated with ConfuserEx/Confuser Core 1.6.0 providing full remote system control (keylogging, screenshot capture, webcam access, remote shell). No CVE is exploited in this campaign; the initial access vector is entirely social-engineering and user-execution based.

## MITRE ATT&CK

- T1566 Phishing
- T1566.001 Spearphishing Attachment
- T1566.002 Spearphishing Link
- T1204.002 Malicious File
- T1059.001 PowerShell
- T1059.003 Windows Command Shell
- T1059.005 Visual Basic
- T1059.007 JavaScript
- T1059.006 Python
- T1047 Windows Management Instrumentation
- T1053.005 Scheduled Task
- T1547.001 Registry Run Keys / Startup Folder
- T1053.005 Scheduled Task
- T1140 Deobfuscate/Decode Files or Information
- T1027 Obfuscated Files or Information
- T1218.010 Regsvr32
- T1218.005 Mshta
- T1218.001 Compiled HTML File
- T1574.001 DLL
- T1055 Process Injection
- T1036.007 Double File Extension
- T1056.001 Keylogging
- T1082 System Information Discovery
- T1033 System Owner/User Discovery
- T1113 Screen Capture
- T1125 Video Capture
- T1560 Archive Collected Data
- T1071.001 Web Protocols
- T1105 Ingress Tool Transfer
- T1102.002 Bidirectional Communication
- T1219 Remote Access Tools
- T1041 Exfiltration Over C2 Channel
- T1567.002 Exfiltration to Cloud Storage

## Sources

- [ASEC 분석 리포트 (94270) — 국내 APT 공격 그룹 동향 (2026년 5월)](https://asec.ahnlab.com/ko/94270/)
- [May 2026 Threat Trend Report on APT Attacks (South Korea) - ASEC](https://asec.ahnlab.com/en/94271/)
- [April 2026 Threat Trend Report on APT Attacks (South Korea) - ASEC](https://asec.ahnlab.com/en/93831/)
- [North Korean Kimsuky Hackers Leveraged GitHub to Attack Foreign Embassies with XenoRAT Malware](https://cybersecuritynews.com/north-korean-kimsuky-hackers-leveraged-github/)
- [XenoRAT malware campaign hits multiple embassies in South Korea](https://www.bleepingcomputer.com/news/security/xenorat-malware-campaign-hits-multiple-embassies-in-south-korea/)
- [DPRK-linked GitHub C2 Espionage Campaign](https://www.trellix.com/en-hk/blogs/research/dprk-linked-github-c2-espionage-campaign/)
- [DPRK-Related Campaigns with LNK and GitHub C2](https://www.fortinet.com/blog/threat-research/dprk-related-campaigns-with-lnk-and-github-c2)
- [MITRE ATT&CK — Kimsuky (G0094)](https://attack.mitre.org/groups/G0094/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1229