July 2026 Domestic APT Attack Trends (South Korea): LNK-Based Spear Phishing Delivering XenoRAT and Info-Stealers

Key facts for South Korea XenoRAT July APT

Detection coverage for South Korea XenoRAT July APT

As of 2026-08-28, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2180 across Splunk SPL, Microsoft KQL and Sigma, covering 24 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: LNK-Initiated Script-Host Spawn from Mail Client or Explorer (ASEC July 2026 Types A-F)

Detects a Windows shortcut (.lnk) opened from a mail-client-extracted attachment or Explorer directly spawning powershell.exe, cmd.exe, wscript.exe, cscript.exe, mshta.exe, or curl.exe — the shared initial-access/execution pattern across ASEC's July 2026 domestic APT Types A-F (LNK-embedded PowerShell decoding HEX/Base64 payloads, curl.exe pulling HTA/BAT stagers, VBS/BAT droppers). Fires on the parent/child pairing rather than any single artifact, since no single hash or URL covers all seven chains.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1566.001, T1204.002, T1059.001, T1105
• Data sources: sysmon, windows_security, microsoft_defender_for_endpoint
• Severity: high
• Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
| eval parent_name=lower(mvindex(split(ParentImage, "\\"), -1))
| eval child_name=lower(mvindex(split(Image, "\\"), -1))
| where (parent_name="explorer.exe" OR match(parent_name, "outlook\.exe|thunderbird\.exe") OR match(ParentCommandLine, "(?i)\.lnk"))
| where match(child_name, "powershell\.exe|cmd\.exe|wscript\.exe|cscript\.exe|mshta\.exe|curl\.exe")
| where match(CommandLine, "(?i)-enc|-encodedcommand|frombase64string|hex|\.hta|-outfile|\btemp\b")
| table _time, ComputerName, User, parent_name, child_name, CommandLine, ParentCommandLine
| sort -_time

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName in~ ("explorer.exe", "outlook.exe", "thunderbird.exe") or InitiatingProcessCommandLine has ".lnk"
| where FileName in~ ("powershell.exe", "cmd.exe", "wscript.exe", "cscript.exe", "mshta.exe", "curl.exe")
| where ProcessCommandLine has_any ("-enc", "-EncodedCommand", "FromBase64String", ".hta", "-outfile", "%TEMP%")
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine, InitiatingProcessCommandLine
| order by Timestamp desc

Sigma

title: LNK-Spawned Script Interpreter or curl.exe Download (ASEC July 2026 Domestic APT)
id: 7f2a4e10-6b3c-4a91-9d2e-1c8f6a0b3e21
status: experimental
description: Detects a .lnk-triggered spawn of a script host or curl.exe consistent with ASEC's July 2026 domestic APT Types A-F spear-phishing chains delivering XenoRAT, backdoors, and info-stealers to South Korean organizations.
references:
  - https://asec.ahnlab.com/ko/95170/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-08-28
tags:
  - attack.initial-access
  - attack.t1566.001
  - attack.execution
  - attack.t1204.002
  - attack.t1059.001
  - attack.t1105
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\explorer.exe'
      - '\outlook.exe'
      - '\thunderbird.exe'
  selection_parent_lnk:
    ParentCommandLine|contains: '.lnk'
  selection_child:
    Image|endswith:
      - '\powershell.exe'
      - '\cmd.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\curl.exe'
  selection_indicators:
    CommandLine|contains:
      - '-enc'
      - '-EncodedCommand'
      - 'FromBase64String'
      - '.hta'
      - '-outfile'
      - '%TEMP%'
  condition: (selection_parent or selection_parent_lnk) and selection_child and selection_indicators
falsepositives:
  - IT-deployed shortcut-based software installers that legitimately launch PowerShell with encoded commands
  - Help-desk remote-support scripts triggered from Explorer shortcuts
level: high

Known false positives:

• IT-packaged software deployed via .lnk shortcuts that legitimately invoke PowerShell/curl for installation
• Help-desk or RMM tooling that spawns script hosts from Explorer during remote support sessions

Tuning notes: Baseline your organization's legitimate .lnk-based software deployment tooling (SCCM, Intune shortcut installers) and add their process names/paths to an allowlist macro; narrow the CommandLine indicator list to reduce noise on hosts with heavy PowerShell-based admin automation.

• 🔒 LNK-Initiated Script-Host Spawn from Mail Client or Explorer (ASEC July 2026 Types A-F) · unlock with TL Creds
• 🔒 Scheduled Task Masquerade + Regsvr32/DLL Side-Load Persistence (ASEC Types A, D, E, F, G) · unlock with TL Creds
• 🔒 Cloud-Service C2 / Stager Retrieval via GitHub, Dropbox, Google Drive, or PubNub (ASEC Types A, B, C, D) · unlock with TL Creds
• 🔒 LNK-Initiated Script-Host Spawn from Mail Client or Explorer (ASEC July 2026 Types A-F) · unlock with TL Creds
• 🔒 Scheduled Task Masquerade + Regsvr32/DLL Side-Load Persistence (ASEC Types A, D, E, F, G) · unlock with TL Creds
• 🔒 PubNub Web-Service C2, Keylogger Artifacts, and Python Backdoor Callback (ASEC Types A, B, F) · unlock with TL Creds
• 🔒 Scheduled Task Masquerade + Regsvr32/DLL Side-Load Persistence (ASEC Types A, D, E, F, G) · unlock with TL Creds
• 🔒 PubNub / Cloud-Service C2 Beaconing and XenoRAT Callback (ASEC Types A, B, C) · unlock with TL Creds

Indicators of compromise for South Korea XenoRAT July APT

As of 2026-08-28, Threadlinqs Intelligence tracks 24 indicators of compromise for TL-2026-2180.

Sample indicators (3 of 24)

• URL: hxxp://jad[.]co[.]kr/banner/item/view.php?bbs=17
• File hash: 0080cd81db3244b8ba157ffabc1d30fe
• URL: hxxp://jad[.]co[.]kr/banner/item/view.php?filter=4XNzW6m9NwOgVKs3xTVwO&page=lnwxWCMKoiz8lekqijFkoAMyUHiD1nGzlat

Defanged, TLP:CLEAR. Full set of 24 indicators: unlock with TL Creds.

How South Korea XenoRAT July APT works

AhnLab's ASEC published its monthly domestic APT attack trend report for July 2026 (report title: '2026년 7월 APT 공격 동향 보고서(국내)'), documenting seven distinct attack chains observed against South Korean entities during the month, labeled Type A through Type G. All seven begin with spear-phishing email carrying a malicious Windows shortcut (.lnk) file disguised as a business document, and six of the seven abuse a mainstream cloud service (OneDrive, Dropbox, GitHub, or Google Drive) somewhere in the delivery or command-and-control path.

Type A's LNK embeds a PowerShell command that decodes HEX-encoded data to drop a decoy document plus a legitimate AutoIt interpreter and a malicious AutoIt script. The AutoIt payload receives commands over a PubNub pub/sub channel (a legitimate real-time messaging platform abused as a covert C2 transport) and exfiltrates results Base64-encoded; persistence is a Scheduled Task disguised as a OneDrive update.

Type B's LNK invokes curl.exe to pull a malicious HTA file into %TEMP%, distributed via GitHub repositories and Google Drive links; the HTA memory-loads an info-stealer, a keylogger, and a backdoor, and the info-stealer collects system information, key-file lists, and virtual-asset (cryptocurrency wallet-related) information — indicating the operators have a financial/crypto-theft interest layered on top of general espionage collection.

Type C's LNK runs PowerShell to construct Base64-encoded data, then pulls a decoy plus additional malicious scripts from a GitHub repository, ultimately deploying XenoRAT (an open-source, C#-based remote access trojan with keylogging, HVNC, and SOCKS5-proxy C2 capability that has previously been used against diplomatic and embassy targets in South Korea) and exfiltrating system information.

Type D restores a legitimate decoy document plus XML, JavaScript, and PowerShell scripts; persistence is a Scheduled Task disguised as a browser update, and the chain retrieves BAT files from a Dropbox-hosted location, collecting username, OS version, public IP address, and the running-process list.

Type E, using a resume/CV-themed lure, drops VBS, BAT, and PowerShell scripts and registers a Scheduled Task, then executes a loader via DLL side-loading combined with process injection to deploy a backdoor.

Type F stages via CMD/PowerShell invoking curl.exe to copy a downloader to %TEMP%, which retrieves a decoy PDF and a BAT-based downloader; the final payload is a Python-based backdoor that persists as a Scheduled Task disguised as pythonw.exe and executes commands received from the attacker's server.

Type G departs from the LNK-first pattern at execution time: regsvr32.exe (a Microsoft-signed binary abused as a script/DLL execution proxy) loads a malicious DLL staged in %ProgramData%, delivering a backdoor capable of user-information theft and other unspecified malicious activity.

ASEC's article names no threat actor, campaign alias, or CVE — this is a monthly trend rollup, not a single-intrusion writeup, and it does not provide file names for decoys, exact scheduled-task names, or a hash/URL-to-type crosswalk. However, the toolset and delivery pattern (LNK-first spear phishing, PowerShell staging, and abuse of Dropbox's API, GitHub Releases/repos, and Google Drive as delivery/C2 channels) is consistent with the TTP pattern ASEC's own adjacent 2026 monthly APT-group reports attribute to Kimsuky-linked activity targeting South Korean and regional targets — noted here as a pattern overlap only, since this specific report does not make that attribution itself. The article does publish five MD5 hashes and five C2/staging URLs, all hosted on compromised or bulletproof-adjacent infrastructure (a compromised South Korean banner-ad script host at jad.co.kr, a compromised South Korean shop site at dilmahshop.co.kr, and a dedicated attacker-registered domain fluxoras.site).

MITRE ATT&CK techniques by tactic:

Collection

T1005 Data from Local System; T1056.001 Input Capture: Keylogging

Defense Evasion

T1027 Obfuscated Files or Information; T1036.005 Match Legitimate Resource Name or Location; T1055 Process Injection; T1218.010 System Binary Proxy Execution: Regsvr32; T1574.001 DLL

Persistence

T1053.005 Scheduled Task/Job: Scheduled Task

Execution

T1059.001 Command and Scripting Interpreter: PowerShell; T1059.005 Command and Scripting Interpreter: Visual Basic; T1059.006 Command and Scripting Interpreter: Python; T1059.007 Command and Scripting Interpreter: JavaScript; T1059.010 Command and Scripting Interpreter: AutoHotKey & AutoIT; T1204.002 User Execution: Malicious File

Discovery

T1082 System Information Discovery

Command and Control

T1102.002 Web Service: Bidirectional Communication

Initial Access

T1566.001 Phishing: Spearphishing Attachment

Remediation for South Korea XenoRAT July APT

Patches

• N/A — this campaign abuses legitimate Windows binaries and cloud services rather than exploiting a specific software vulnerability; no CVE or vendor patch applies

Immediate actions

• Block the five published C2/staging URLs and their hosting domains (jad.co.kr, dilmahshop.co.kr, fluxoras.site) at the perimeter proxy/DNS layer
• Hunt for the five published MD5 hashes across endpoint AV/EDR telemetry
• Block or alert on LNK, HTA, and VBS attachments arriving via email, especially from external senders with business-document-themed subjects
• Alert on curl.exe, regsvr32.exe, mshta.exe, and wscript.exe/cscript.exe spawned as a child process of explorer.exe or a mail client

Workarounds

• Disable or restrict Windows Script Host (wscript.exe/cscript.exe) execution for standard users
• Block direct execution of .lnk-embedded PowerShell via Group Policy / Constrained Language Mode
• Enforce email gateway stripping or sandboxing of .lnk, .hta, and .vbs attachments

Longer-term hardening

• Deploy EDR with behavioral detection for LOLBin abuse (curl.exe download-and-execute, regsvr32.exe loading non-system DLLs, DLL side-loading, process injection)
• Restrict or monitor outbound access to PubNub, Dropbox API, GitHub, and Google Drive endpoints from endpoint/user segments where such traffic is not business-justified
• Audit Scheduled Task creation events (Event ID 4698) for tasks masquerading as OneDrive/browser updates or as pythonw.exe
• Apply Windows Attack Surface Reduction rules to block Office/LNK-initiated child processes and script-host execution

Affected and fixed versions

• Microsoft — Windows (LNK, HTA, PowerShell, regsvr32.exe, Task Scheduler execution surface)
  Vulnerable versions: N/A — technique/LOLBin abuse, not a software vulnerability
  Fixed in: N/A

Timeline of South Korea XenoRAT July APT

• 2026-07-01 Type G: locked-ioc-14 loads a malicious DLL staged in %ProgramData%, delivering a backdoor capable of user-information theft and other malicious activity.
• 2026-07-01 Type F: CMD/locked-ioc-16 invokes locked-ioc-18 to stage a downloader that retrieves a decoy PDF and a BAT downloader, deploying a Python backdoor persisted as a Scheduled Task disguised as pythonw.exe.
• 2026-07-01 Type E: resume/CV-themed LNK drops VBS/BAT/locked-ioc-16, registers a Scheduled Task, then executes a loader via DLL side-loading combined with process injection to deploy backdoor malware.
• 2026-07-01 Type D: restores a legitimate decoy document plus XML/JavaScript/locked-ioc-16 scripts, registers a Scheduled Task disguised as a browser update, retrieves BAT files from locked-ioc-21, and collects username, OS info, public IP, and running-process lists.
• 2026-07-01 Type C: LNK-triggered locked-ioc-16 builds Base64-encoded data and pulls a decoy plus malicious scripts from locked-ioc-24, deploying locked-ioc-20 and exfiltrating system information.
• 2026-07-01 Type B: LNK invokes locked-ioc-18 to pull a malicious HTA into %TEMP%, distributed via locked-ioc-24 repositories and locked-ioc-15; the HTA memory-loads an info-stealer, locked-ioc-17, and backdoor that collect system information, key-file lists, and virtual-asset (cryptocurrency) information.
• 2026-07-01 Type A: LNK-embedded locked-ioc-16 decodes HEX data to drop a decoy document plus a legitimate locked-ioc-22 interpreter and malicious locked-ioc-22 script; the script receives commands over a locked-ioc-23 channel and Base64-exfiltrates results; persistence via a Scheduled Task disguised as a locked-ioc-19 update.
• 2026-07-01 ASEC's July 2026 monitoring window opens; seven distinct LNK/HTA-based spear-phishing infection chains (Types A-G) targeting South Korean organizations are active through the month.
• 2026-07-31 ASEC's July 2026 monitoring window closes; findings across all seven attack types are compiled for the monthly domestic APT trend report.
• 2026-08-28 ASEC publishes '2026년 7월 APT 공격 동향 보고서(국내)' (July 2026 Domestic APT Attack Trends Report), documenting all seven attack types with five MD5 hashes and five C2/staging URLs.

Sources cited for South Korea XenoRAT July APT

• 2026년 7월 APT 공격 동향 보고서(국내) [July 2026 APT Attack Trends Report (Domestic)] asec.ahnlab.com · Vendor report · 2026-08-28
• June 2026 Threat Trend Report on APT Attacks (South Korea) asec.ahnlab.com · Vendor report · 2026-08-01
• Kimsuky tag archive — ASEC asec.ahnlab.com · Vendor report · 2026-08-28
• XenoRAT (Malware Family) — Malpedia malpedia.caad.fkie.fraunhofer.de · Research · 2026-08-28
• XenoRAT Malware: Features and Mitigation Strategies hunt.io · Research · 2026-08-28
• Xeno RAT: A New Remote Access Trojan with Advance Capabilities cyfirma.com · Research · 2026-08-28
• Open-Source Xeno RAT Trojan Emerges as a Potent Threat on GitHub The Hacker News · News · 2024-02-01

Threats related to South Korea XenoRAT July APT

• AutoIT Payload Injector Delivers VIPKeylogger via Phishing/RAR Chain into charmap.exe
• Domestic APT Spear-Phishing Campaigns (May 2026) — LNK/HTA/CHM/JSE Loaders Deploying XenoRAT, Suspected Kimsuky
• Larva-26005 APT Campaign: Xctdoor and CRAT Backdoors Targeting South Korea (2020–2026)

Previous and next in apt

• BlueDelta (GRU/APT28) Targets Defense and Diplomacy with HOOKEDGE Backdoor Previous report
• BREEZE COMET (ex-UNC5669) Targets Brazilian Financial Infrastructure with AI-Assisted Custom Malware Suite Next report