# July 2026 Domestic APT Attack Trends (South Korea): LNK-Based Spear Phishing Delivering XenoRAT and Info-Stealers

> ASEC's July 2026 domestic APT trend report documents seven distinct LNK/HTA-based spear-phishing infection chains (Types A-G) targeting South Korean organizations, abusing PowerShell, curl.exe, and regsvr32.exe alongside OneDrive, Dropbox, GitHub, Google Drive, and PubNub to deliver XenoRAT, generic backdoors, a Python backdoor, info-stealers, and keyloggers.

- **Published:** 2026-08-28T00:00:00Z
- **Last reviewed:** 2026-08-28T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2180
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-south-korea-xenorat-july-apt-tl-2026-2180.webp?v=52c48ac4 (Threadlinqs threat intel: South Korea XenoRAT APT July Trends: Detection & IOCs (TL-2026-2180) — High severity, 24 IOCs, 9 detection rules.)
- **ID:** TL-2026-2180
- **Severity:** HIGH
- **Category:** APT
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 24 (3 shown free below)

## Description

AhnLab's ASEC published its monthly domestic APT attack trend report for July 2026 (report title: '2026년 7월 APT 공격 동향 보고서(국내)'), documenting seven distinct attack chains observed against South Korean entities during the month, labeled Type A through Type G. All seven begin with spear-phishing email carrying a malicious Windows shortcut (.lnk) file disguised as a business document, and six of the seven abuse a mainstream cloud service (OneDrive, Dropbox, GitHub, or Google Drive) somewhere in the delivery or command-and-control path.

Type A's LNK embeds a PowerShell command that decodes HEX-encoded data to drop a decoy document plus a legitimate AutoIt interpreter and a malicious AutoIt script. The AutoIt payload receives commands over a PubNub pub/sub channel (a legitimate real-time messaging platform abused as a covert C2 transport) and exfiltrates results Base64-encoded; persistence is a Scheduled Task disguised as a OneDrive update.

Type B's LNK invokes curl.exe to pull a malicious HTA file into %TEMP%, distributed via GitHub repositories and Google Drive links; the HTA memory-loads an info-stealer, a keylogger, and a backdoor, and the info-stealer collects system information, key-file lists, and virtual-asset (cryptocurrency wallet-related) information — indicating the operators have a financial/crypto-theft interest layered on top of general espionage collection.

Type C's LNK runs PowerShell to construct Base64-encoded data, then pulls a decoy plus additional malicious scripts from a GitHub repository, ultimately deploying XenoRAT (an open-source, C#-based remote access trojan with keylogging, HVNC, and SOCKS5-proxy C2 capability that has previously been used against diplomatic and embassy targets in South Korea) and exfiltrating system information.

Type D restores a legitimate decoy document plus XML, JavaScript, and PowerShell scripts; persistence is a Scheduled Task disguised as a browser update, and the chain retrieves BAT files from a Dropbox-hosted location, collecting username, OS version, public IP address, and the running-process list.

Type E, using a resume/CV-themed lure, drops VBS, BAT, and PowerShell scripts and registers a Scheduled Task, then executes a loader via DLL side-loading combined with process injection to deploy a backdoor.

Type F stages via CMD/PowerShell invoking curl.exe to copy a downloader to %TEMP%, which retrieves a decoy PDF and a BAT-based downloader; the final payload is a Python-based backdoor that persists as a Scheduled Task disguised as pythonw.exe and executes commands received from the attacker's server.

Type G departs from the LNK-first pattern at execution time: regsvr32.exe (a Microsoft-signed binary abused as a script/DLL execution proxy) loads a malicious DLL staged in %ProgramData%, delivering a backdoor capable of user-information theft and other unspecified malicious activity.

ASEC's article names no threat actor, campaign alias, or CVE — this is a monthly trend rollup, not a single-intrusion writeup, and it does not provide file names for decoys, exact scheduled-task names, or a hash/URL-to-type crosswalk. However, the toolset and delivery pattern (LNK-first spear phishing, PowerShell staging, and abuse of Dropbox's API, GitHub Releases/repos, and Google Drive as delivery/C2 channels) is consistent with the TTP pattern ASEC's own adjacent 2026 monthly APT-group reports attribute to Kimsuky-linked activity targeting South Korean and regional targets — noted here as a pattern overlap only, since this specific report does not make that attribution itself. The article does publish five MD5 hashes and five C2/staging URLs, all hosted on compromised or bulletproof-adjacent infrastructure (a compromised South Korean banner-ad script host at jad.co.kr, a compromised South Korean shop site at dilmahshop.co.kr, and a dedicated attacker-registered domain fluxoras.site).

## MITRE ATT&CK

- T1566.001 Phishing: Spearphishing Attachment
- T1204.002 User Execution: Malicious File
- T1059.001 Command and Scripting Interpreter: PowerShell
- T1059.005 Command and Scripting Interpreter: Visual Basic
- T1059.006 Command and Scripting Interpreter: Python
- T1059.007 Command and Scripting Interpreter: JavaScript
- T1059.010 Command and Scripting Interpreter: AutoHotKey & AutoIT
- T1053.005 Scheduled Task/Job: Scheduled Task
- T1574.001 DLL
- T1055 Process Injection
- T1218.010 System Binary Proxy Execution: Regsvr32
- T1036.005 Match Legitimate Resource Name or Location
- T1027 Obfuscated Files or Information
- T1082 System Information Discovery
- T1056.001 Input Capture: Keylogging
- T1005 Data from Local System
- T1102.002 Web Service: Bidirectional Communication

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**LNK-Initiated Script-Host Spawn from Mail Client or Explorer (ASEC July 2026 Types A-F)** (`TL-2026-2180-SPL-001`)

Detects a Windows shortcut (.lnk) opened from a mail-client-extracted attachment or Explorer directly spawning powershell.exe, cmd.exe, wscript.exe, cscript.exe, mshta.exe, or curl.exe — the shared initial-access/execution pattern across ASEC's July 2026 domestic APT Types A-F (LNK-embedded PowerShell decoding HEX/Base64 payloads, curl.exe pulling HTA/BAT stagers, VBS/BAT droppers). Fires on the parent/child pairing rather than any single artifact, since no single hash or URL covers all seven chains.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1566.001, T1204.002, T1059.001, T1105
- **Data sources:** sysmon, windows_security, microsoft_defender_for_endpoint
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
| eval parent_name=lower(mvindex(split(ParentImage, "\\"), -1))
| eval child_name=lower(mvindex(split(Image, "\\"), -1))
| where (parent_name="explorer.exe" OR match(parent_name, "outlook\.exe|thunderbird\.exe") OR match(ParentCommandLine, "(?i)\.lnk"))
| where match(child_name, "powershell\.exe|cmd\.exe|wscript\.exe|cscript\.exe|mshta\.exe|curl\.exe")
| where match(CommandLine, "(?i)-enc|-encodedcommand|frombase64string|hex|\.hta|-outfile|\btemp\b")
| table _time, ComputerName, User, parent_name, child_name, CommandLine, ParentCommandLine
| sort -_time
```

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName in~ ("explorer.exe", "outlook.exe", "thunderbird.exe") or InitiatingProcessCommandLine has ".lnk"
| where FileName in~ ("powershell.exe", "cmd.exe", "wscript.exe", "cscript.exe", "mshta.exe", "curl.exe")
| where ProcessCommandLine has_any ("-enc", "-EncodedCommand", "FromBase64String", ".hta", "-outfile", "%TEMP%")
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine, InitiatingProcessCommandLine
| order by Timestamp desc
```

### Sigma

```yaml
title: LNK-Spawned Script Interpreter or curl.exe Download (ASEC July 2026 Domestic APT)
id: 7f2a4e10-6b3c-4a91-9d2e-1c8f6a0b3e21
status: experimental
description: Detects a .lnk-triggered spawn of a script host or curl.exe consistent with ASEC's July 2026 domestic APT Types A-F spear-phishing chains delivering XenoRAT, backdoors, and info-stealers to South Korean organizations.
references:
  - https://asec.ahnlab.com/ko/95170/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-08-28
tags:
  - attack.initial-access
  - attack.t1566.001
  - attack.execution
  - attack.t1204.002
  - attack.t1059.001
  - attack.t1105
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\explorer.exe'
      - '\outlook.exe'
      - '\thunderbird.exe'
  selection_parent_lnk:
    ParentCommandLine|contains: '.lnk'
  selection_child:
    Image|endswith:
      - '\powershell.exe'
      - '\cmd.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\curl.exe'
  selection_indicators:
    CommandLine|contains:
      - '-enc'
      - '-EncodedCommand'
      - 'FromBase64String'
      - '.hta'
      - '-outfile'
      - '%TEMP%'
  condition: (selection_parent or selection_parent_lnk) and selection_child and selection_indicators
falsepositives:
  - IT-deployed shortcut-based software installers that legitimately launch PowerShell with encoded commands
  - Help-desk remote-support scripts triggered from Explorer shortcuts
level: high
```

**Known false positives:**

- IT-packaged software deployed via .lnk shortcuts that legitimately invoke PowerShell/curl for installation
- Help-desk or RMM tooling that spawns script hosts from Explorer during remote support sessions

**Tuning notes:** Baseline your organization's legitimate .lnk-based software deployment tooling (SCCM, Intune shortcut installers) and add their process names/paths to an allowlist macro; narrow the CommandLine indicator list to reduce noise on hosts with heavy PowerShell-based admin automation.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- LNK-Initiated Script-Host Spawn from Mail Client or Explorer (ASEC July 2026 Types A-F) (locked: unlock with TL Creds)
- Scheduled Task Masquerade + Regsvr32/DLL Side-Load Persistence (ASEC Types A, D, E, F, G) (locked: unlock with TL Creds)
- Cloud-Service C2 / Stager Retrieval via GitHub, Dropbox, Google Drive, or PubNub (ASEC Types A, B, C, D) (locked: unlock with TL Creds)
- LNK-Initiated Script-Host Spawn from Mail Client or Explorer (ASEC July 2026 Types A-F) (locked: unlock with TL Creds)
- Scheduled Task Masquerade + Regsvr32/DLL Side-Load Persistence (ASEC Types A, D, E, F, G) (locked: unlock with TL Creds)
- PubNub Web-Service C2, Keylogger Artifacts, and Python Backdoor Callback (ASEC Types A, B, F) (locked: unlock with TL Creds)
- Scheduled Task Masquerade + Regsvr32/DLL Side-Load Persistence (ASEC Types A, D, E, F, G) (locked: unlock with TL Creds)
- PubNub / Cloud-Service C2 Beaconing and XenoRAT Callback (ASEC Types A, B, C) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 24)

Defanged, TLP:CLEAR.

- URL: `hxxp://jad[.]co[.]kr/banner/item/view.php?bbs=17`
- File hash: `0080cd81db3244b8ba157ffabc1d30fe`
- URL: `hxxp://jad[.]co[.]kr/banner/item/view.php?filter=4XNzW6m9NwOgVKs3xTVwO&page=lnwxWCMKoiz8lekqijFkoAMyUHiD1nGzlat`

Full set of 24 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [2026년 7월 APT 공격 동향 보고서(국내) July 2026 APT Attack Trends Report (Domestic)](https://asec.ahnlab.com/ko/95170/)
- [June 2026 Threat Trend Report on APT Attacks (South Korea)](https://asec.ahnlab.com/en/94594/)
- [Kimsuky tag archive — ASEC](https://asec.ahnlab.com/en/tag/kimsuky-en/)
- [XenoRAT (Malware Family) — Malpedia](https://malpedia.caad.fkie.fraunhofer.de/details/win.xenorat)
- [XenoRAT Malware: Features and Mitigation Strategies](https://hunt.io/malware-families/xenorat)
- [Open-Source Xeno RAT Trojan Emerges as a Potent Threat on GitHub](https://thehackernews.com/2024/02/open-source-xeno-rat-trojan-emerges-as.html)
- [Xeno RAT: A New Remote Access Trojan with Advance Capabilities](https://www.cyfirma.com/research/xeno-rat-a-new-remote-access-trojan-with-advance-capabilities/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2180