July 2026 Domestic APT Attack Trends (South Korea): LNK-Based Spear Phishing Delivering XenoRAT and Info-Stealers — Threadlinqs Intelligence
As of 2026-08-28, July 2026 Domestic APT Attack Trends (South Korea): LNK-Based Spear Phishing Delivering XenoRAT and Info-Stealers is a high-severity apt threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 24 indicators of compromise.
Threat ID: TL-2026-2180 · Severity: HIGH · Status: ACTIVE · Category: APT
ASEC's July 2026 domestic APT trend report documents seven distinct LNK/HTA-based spear-phishing infection chains (Types A-G) targeting South Korean organizations, abusing PowerShell, curl.exe, and
AhnLab's ASEC published its monthly domestic APT attack trend report for July 2026 (report title: '2026년 7월 APT 공격 동향 보고서(국내)'), documenting seven distinct attack chains observed against South Korean entities during the month, labeled Type A through Type G. All seven begin with spear-phishing email carrying a malicious Windows shortcut (.lnk) file disguised as a business document, and six of the seven abuse a mainstream cloud service (OneDrive, Dropbox, GitHub, or Google Drive) somewhere in the delivery or command-and-control path.
Type A's LNK embeds a PowerShell command that decodes HEX-encoded data to drop a decoy document plus a legitimate AutoIt interpreter and a malicious AutoIt script. The AutoIt payload receives commands over a PubNub pub/sub channel (a legitimate real-time messaging platform abused as a covert C2 transport) and exfiltrates results Base64-encoded; persistence is a Scheduled Task disguised as a OneDrive update.
Type B's LNK invokes curl.exe to pull a malicious HTA file into %TEMP%, distributed via GitHub repositories and Google Drive links; the HTA memory-loads an info-stealer, a keylogger, and a backdoor, and the info-stealer collects system information, key-file lists, and virtual-asset (cryptocurrency wallet-related) information — indicating the operators have a financial/crypto-theft interest layered on top of general espionage collection.
Type C's LNK runs PowerShell to construct Base64-encoded data, then pulls a decoy plus additional malicious scripts from a GitHub repository, ultimately deploying XenoRAT (an open-source, C#-based remote access trojan with keylogging, HVNC, and SOCKS5-proxy C2 capability that has previously been used against diplomatic and embassy targets in South Korea) and exfiltrating system information.
Type D restores a legitimate decoy document plus XML, JavaScript, and PowerShell scripts; persistence is a Scheduled Task disguised as a browser update, and the chain retrieves BAT files from a Dropbox-hosted location, collecting username, OS version, public IP address, and the running-process list.
Type E, using a resume/CV-themed lure, drops VBS, BAT, and PowerShell scripts and registers a Scheduled Task, then executes a loader via DLL side-loading combined with process injection to deploy a backdoor.
Type F stages via CMD/PowerShell invoking curl.exe to copy a downloader to %TEMP%, which retrieves a decoy PDF and a BAT-based downloader; the final payload is a Python-based backdoor that persists as a Scheduled Task disguised as pythonw.exe and executes commands received from the attacker's server.
Type G departs from the LNK-first pattern at execution time: regsvr32.exe (a Microsoft-signed binary abused as a script/DLL execution proxy) loads a malicious DLL staged in %ProgramData%, delivering a backdoor capable of user-information theft and other unspecified malicious activity.
ASEC's article names no threat actor, campaign alias, or CVE — this is a monthly trend rollup, not a single-intrusion writeup, and it does not provide file names for decoys, exact scheduled-task names, or a hash/URL-to-type crosswalk. However, the toolset and delivery pattern (LNK-first spear phishing, PowerShell staging, and abuse of Dropbox's API, GitHub Releases/repos, and Google Drive as delivery/C2 channels) is consistent with the TTP pattern ASEC's own adjacent 2026 monthly APT-group reports attribute to Kimsuky-linked activity targeting South Korean and regional targets — noted here as a pattern overlap only, since this specific report does not make that attribution itself. The article does publish five MD5 hashes and five C2/staging URLs, all hosted on compromised or bulletproof-adjacent infrastructure (a compromised South Korean banner-ad script host at jad.co.kr, a compromised South Korean shop site at dilmahshop.co.kr, and a dedicated attacker-registered domain fluxoras.site).
Target sectors: business
Target regions: south korea
Timeline
- ASEC's July 2026 monitoring window opens; seven distinct LNK/HTA-based spear-phishing infection chains (Types A-G) targeting South Korean organizations are active through the month.
- Type A: LNK-embedded PowerShell decodes HEX data to drop a decoy document plus a legitimate AutoIt interpreter and malicious AutoIt script; the script receives commands over a PubNub channel and Base64-exfiltrates results; persistence via a Scheduled Task disguised as a OneDrive update.
- Type B: LNK invokes curl.exe to pull a malicious HTA into %TEMP%, distributed via GitHub repositories and Google Drive; the HTA memory-loads an info-stealer, keylogger, and backdoor that collect system information, key-file lists, and virtual-asset (cryptocurrency) information.
- Type C: LNK-triggered PowerShell builds Base64-encoded data and pulls a decoy plus malicious scripts from GitHub, deploying XenoRAT and exfiltrating system information.
- Type D: restores a legitimate decoy document plus XML/JavaScript/PowerShell scripts, registers a Scheduled Task disguised as a browser update, retrieves BAT files from Dropbox, and collects username, OS info, public IP, and running-process lists.
- Type E: resume/CV-themed LNK drops VBS/BAT/PowerShell, registers a Scheduled Task, then executes a loader via DLL side-loading combined with process injection to deploy backdoor malware.
- Type F: CMD/PowerShell invokes curl.exe to stage a downloader that retrieves a decoy PDF and a BAT downloader, deploying a Python backdoor persisted as a Scheduled Task disguised as pythonw.exe.
- Type G: regsvr32.exe loads a malicious DLL staged in %ProgramData%, delivering a backdoor capable of user-information theft and other malicious activity.
- ASEC's July 2026 monitoring window closes; findings across all seven attack types are compiled for the monthly domestic APT trend report.
- ASEC publishes '2026년 7월 APT 공격 동향 보고서(국내)' (July 2026 Domestic APT Attack Trends Report), documenting all seven attack types with five MD5 hashes and five C2/staging URLs.
Detections & IOCs
As of 2026-09-06, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 24 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
APT, HIGH, threat intelligence, cybersecurity, T1566.001, T1204.002, T1059.001, T1059.005, T1059.006, T1059.007, T1059.010, T1053.005, T1574.001, T1055
