July 2026 Domestic APT Attack Trends (South Korea): LNK-Based Spear Phishing Delivering XenoRAT and Info-Stealers
July 2026 Domestic APT Attack Trends (South Korea) (TL-2026-2180) is a high-severity advanced persistent threat campaign, first published 2026-08-28. It has no confirmed attribution, affects Microsoft Windows (LNK, HTA, PowerShell, regsvr32.exe, Task Scheduler, maps to 17 MITRE ATT&CK techniques (T1005, T1027, T1036.005), and is covered by 9 detection rules and 24 indicators of compromise.
Key facts for TL-2026-2180
- Threat ID
- TL-2026-2180
- Severity
- HIGH
- Status
- ACTIVE
- Category
- APT
- First published
- 2026-08-28
- Last reviewed
- 2026-08-28
- Attribution confidence
- LOW
- Motivation
- ESPIONAGE
- Target sectors
- business
- Target regions
- south korea
- Detection rules
- 9
- Indicators of compromise
- 24
Malware and tooling in July 2026 Domestic APT Attack Trends (South Korea)
Malware and tooling: Generic memory-loaded backdoor, Info-stealer (system/key-file/virtual-asset collector), Keylogger, Python-based backdoor, Rakhni, XenoRAT, AutoIt, PowerShell, PubNub, curl.exe, regsvr32.exe
ASEC's July 2026 domestic APT trend report documents seven distinct LNK/HTA-based spear-phishing infection chains (Types A-G) targeting South Korean organizations, abusing PowerShell, curl.exe, and regsvr32.exe alongside OneDrive, Dropbox, GitHub, Google Drive, and PubNub to deliver XenoRAT, generic backdoors, a Python backdoor, info-stealers, and keyloggers.
How July 2026 Domestic APT Attack Trends (South Korea) works
AhnLab's ASEC published its monthly domestic APT attack trend report for July 2026 (report title: '2026년 7월 APT 공격 동향 보고서(국내)'), documenting seven distinct attack chains observed against South Korean entities during the month, labeled Type A through Type G. All seven begin with spear-phishing email carrying a malicious Windows shortcut (.lnk) file disguised as a business document, and six of the seven abuse a mainstream cloud service (OneDrive, Dropbox, GitHub, or Google Drive) somewhere in the delivery or command-and-control path.
Type A's LNK embeds a PowerShell command that decodes HEX-encoded data to drop a decoy document plus a legitimate AutoIt interpreter and a malicious AutoIt script. The AutoIt payload receives commands over a PubNub pub/sub channel (a legitimate real-time messaging platform abused as a covert C2 transport) and exfiltrates results Base64-encoded; persistence is a Scheduled Task disguised as a OneDrive update.
Type B's LNK invokes curl.exe to pull a malicious HTA file into %TEMP%, distributed via GitHub repositories and Google Drive links; the HTA memory-loads an info-stealer, a keylogger, and a backdoor, and the info-stealer collects system information, key-file lists, and virtual-asset (cryptocurrency wallet-related) information — indicating the operators have a financial/crypto-theft interest layered on top of general espionage collection.
Type C's LNK runs PowerShell to construct Base64-encoded data, then pulls a decoy plus additional malicious scripts from a GitHub repository, ultimately deploying XenoRAT (an open-source, C#-based remote access trojan with keylogging, HVNC, and SOCKS5-proxy C2 capability that has previously been used against diplomatic and embassy targets in South Korea) and exfiltrating system information.
Type D restores a legitimate decoy document plus XML, JavaScript, and PowerShell scripts; persistence is a Scheduled Task disguised as a browser update, and the chain retrieves BAT files from a Dropbox-hosted location, collecting username, OS version, public IP address, and the running-process list.
Type E, using a resume/CV-themed lure, drops VBS, BAT, and PowerShell scripts and registers a Scheduled Task, then executes a loader via DLL side-loading combined with process injection to deploy a backdoor.
Type F stages via CMD/PowerShell invoking curl.exe to copy a downloader to %TEMP%, which retrieves a decoy PDF and a BAT-based downloader; the final payload is a Python-based backdoor that persists as a Scheduled Task disguised as pythonw.exe and executes commands received from the attacker's server.
Type G departs from the LNK-first pattern at execution time: regsvr32.exe (a Microsoft-signed binary abused as a script/DLL execution proxy) loads a malicious DLL staged in %ProgramData%, delivering a backdoor capable of user-information theft and other unspecified malicious activity.
ASEC's article names no threat actor, campaign alias, or CVE — this is a monthly trend rollup, not a single-intrusion writeup, and it does not provide file names for decoys, exact scheduled-task names, or a hash/URL-to-type crosswalk. However, the toolset and delivery pattern (LNK-first spear phishing, PowerShell staging, and abuse of Dropbox's API, GitHub Releases/repos, and Google Drive as delivery/C2 channels) is consistent with the TTP pattern ASEC's own adjacent 2026 monthly APT-group reports attribute to Kimsuky-linked activity targeting South Korean and regional targets — noted here as a pattern overlap only, since this specific report does not make that attribution itself. The article does publish five MD5 hashes and five C2/staging URLs, all hosted on compromised or bulletproof-adjacent infrastructure (a compromised South Korean banner-ad script host at jad.co.kr, a compromised South Korean shop site at dilmahshop.co.kr, and a dedicated attacker-registered domain fluxoras.site).
MITRE ATT&CK techniques used in TL-2026-2180
Collection
T1005 Data from Local System; T1056.001 Input Capture: Keylogging
Defense Evasion
T1027 Obfuscated Files or Information; T1036.005 Match Legitimate Resource Name or Location; T1055 Process Injection; T1218.010 System Binary Proxy Execution: Regsvr32; T1574.001 DLL
Persistence
T1053.005 Scheduled Task/Job: Scheduled Task
Execution
T1059.001 Command and Scripting Interpreter: PowerShell; T1059.005 Command and Scripting Interpreter: Visual Basic; T1059.006 Command and Scripting Interpreter: Python; T1059.007 Command and Scripting Interpreter: JavaScript; T1059.010 Command and Scripting Interpreter: AutoHotKey & AutoIT; T1204.002 User Execution: Malicious File
Discovery
T1082 System Information Discovery
Command and Control
T1102.002 Web Service: Bidirectional Communication
Initial Access
Affected products and versions in July 2026 Domestic APT Attack Trends (South Korea)
- Microsoft — Windows (LNK, HTA, PowerShell, regsvr32.exe, Task Scheduler execution surface)
Vulnerable versions: N/A — technique/LOLBin abuse, not a software vulnerability
Fixed in: N/A
Remediation for July 2026 Domestic APT Attack Trends (South Korea)
Patches
- N/A — this campaign abuses legitimate Windows binaries and cloud services rather than exploiting a specific software vulnerability; no CVE or vendor patch applies
Immediate actions
- Block the five published C2/staging URLs and their hosting domains (jad.co.kr, dilmahshop.co.kr, fluxoras.site) at the perimeter proxy/DNS layer
- Hunt for the five published MD5 hashes across endpoint AV/EDR telemetry
- Block or alert on LNK, HTA, and VBS attachments arriving via email, especially from external senders with business-document-themed subjects
- Alert on curl.exe, regsvr32.exe, mshta.exe, and wscript.exe/cscript.exe spawned as a child process of explorer.exe or a mail client
Workarounds
- Disable or restrict Windows Script Host (wscript.exe/cscript.exe) execution for standard users
- Block direct execution of .lnk-embedded PowerShell via Group Policy / Constrained Language Mode
- Enforce email gateway stripping or sandboxing of .lnk, .hta, and .vbs attachments
Longer-term hardening
- Deploy EDR with behavioral detection for LOLBin abuse (curl.exe download-and-execute, regsvr32.exe loading non-system DLLs, DLL side-loading, process injection)
- Restrict or monitor outbound access to PubNub, Dropbox API, GitHub, and Google Drive endpoints from endpoint/user segments where such traffic is not business-justified
- Audit Scheduled Task creation events (Event ID 4698) for tasks masquerading as OneDrive/browser updates or as pythonw.exe
- Apply Windows Attack Surface Reduction rules to block Office/LNK-initiated child processes and script-host execution
Timeline of July 2026 Domestic APT Attack Trends (South Korea)
- Type G: regsvr32.exe loads a malicious DLL staged in %ProgramData%, delivering a backdoor capable of user-information theft and other malicious activity.
- Type F: CMD/PowerShell invokes curl.exe to stage a downloader that retrieves a decoy PDF and a BAT downloader, deploying a Python backdoor persisted as a Scheduled Task disguised as pythonw.exe.
- Type E: resume/CV-themed LNK drops VBS/BAT/PowerShell, registers a Scheduled Task, then executes a loader via DLL side-loading combined with process injection to deploy backdoor malware.
- Type D: restores a legitimate decoy document plus XML/JavaScript/PowerShell scripts, registers a Scheduled Task disguised as a browser update, retrieves BAT files from Dropbox, and collects username, OS info, public IP, and running-process lists.
- Type C: LNK-triggered PowerShell builds Base64-encoded data and pulls a decoy plus malicious scripts from GitHub, deploying XenoRAT and exfiltrating system information.
- Type B: LNK invokes curl.exe to pull a malicious HTA into %TEMP%, distributed via GitHub repositories and Google Drive; the HTA memory-loads an info-stealer, keylogger, and backdoor that collect system information, key-file lists, and virtual-asset (cryptocurrency) information.
- Type A: LNK-embedded PowerShell decodes HEX data to drop a decoy document plus a legitimate AutoIt interpreter and malicious AutoIt script; the script receives commands over a PubNub channel and Base64-exfiltrates results; persistence via a Scheduled Task disguised as a OneDrive update.
- ASEC's July 2026 monitoring window opens; seven distinct LNK/HTA-based spear-phishing infection chains (Types A-G) targeting South Korean organizations are active through the month.
- ASEC's July 2026 monitoring window closes; findings across all seven attack types are compiled for the monthly domestic APT trend report.
- ASEC publishes '2026년 7월 APT 공격 동향 보고서(국내)' (July 2026 Domestic APT Attack Trends Report), documenting all seven attack types with five MD5 hashes and five C2/staging URLs.
Sources cited for July 2026 Domestic APT Attack Trends (South Korea)
- 2026년 7월 APT 공격 동향 보고서(국내) [July 2026 APT Attack Trends Report (Domestic)]
- June 2026 Threat Trend Report on APT Attacks (South Korea)
- Kimsuky tag archive — ASEC
- XenoRAT (Malware Family) — Malpedia
- XenoRAT Malware: Features and Mitigation Strategies
- Open-Source Xeno RAT Trojan Emerges as a Potent Threat on GitHub
- Xeno RAT: A New Remote Access Trojan with Advance Capabilities
More in apt
- Nation-State and Financially Motivated Actors Weaponize Claude AI Multi-Agent Frameworks for Automated Cyberattacks and Data Theft
- Midnight Blizzard (GTG-20006) Used Claude AI Agents to Automate Malware Evasion, Hijack Hotel Wi-Fi (CaptiveCrunch), and Take Over WhatsApp Accounts Against Ukrainian/European Government and Drone-Supply-Chain Targets
- Iran Exploits SS7 Roaming Infrastructure and Commercial Ad-Tech to Track US Military Smartphones During Operation Epic Fury
- China-Based AI Companies Conducting Industrial-Scale Knowledge Distillation Campaigns Against U.S. Frontier AI Models
- China-Nexus and India-Nexus Espionage Groups Converge on Pakistani Law Enforcement Digitalization Platforms ("One Target, Two Flags")
Detection coverage for TL-2026-2180
As of 2026-08-28, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2180 across Splunk SPL, Microsoft KQL and Sigma, covering 24 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.