# AhnLab ASEC August 2026 APT Attack Trend Report (South Korea): LNK Spear Phishing Delivering XenoRAT and Script-Based Backdoors

> AhnLab ASEC's monthly report on APT activity against South Korean targets describes six spear-phishing-driven attack types (A-F) in August 2026, mostly malicious LNK files that drop decoy documents and deploy AutoIt, PowerShell, VBS, BAT and Python backdoors, XenoRAT variants, and DLL side-loaded implants. The report names no threat actor.

- **Published:** 2026-09-30T00:00:00Z
- **Last reviewed:** 2026-09-30T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2800
- **ID:** TL-2026-2800
- **Severity:** HIGH
- **Category:** APT
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 29 (full data via the Threadlinqs MCP server — Purple tier)

## Description

AhnLab Security Emergency response Center (ASEC) published its August 2026 domestic APT trend report on 2026-09-30, classifying the month's APT attacks against South Korean targets by delivery chain. Spear phishing with malicious LNK files dominates.

Type A: an LNK embeds a PowerShell script that restores HEX-encoded data into a legitimate decoy document, a legitimate AutoIt interpreter and a malicious AutoIt script. The script runs from C:\ProgramData and persists through a scheduled task disguised as a OneDrive update. Commands are retrieved through PubNub channels, and collected data is sent out Base64-encoded.

Type B: Windows-native curl.exe downloads a malicious HTA file into %TEMP%. The HTA is hosted on GitHub repositories or Google Drive. It creates decoy files and a downloader named sys.dll, which loads infostealers, keyloggers and backdoors into memory.

Type C: LNK-embedded PowerShell writes Base64 data in %temp% and executes it, pulls decoy files and further malicious scripts from GitHub, creates scheduled tasks, exfiltrates system information and deploys XenoRAT-type malware.

Type D: LNK files masquerading as resumes or other documents carry a legitimate decoy plus malicious PowerShell. They generate VBS, BAT and PowerShell scripts registered in Task Scheduler, download supplementary files and use DLL side-loading to inject a backdoor into legitimate processes.

Type E: LNK files use CMD and PowerShell to copy curl.exe into %TEMP% and download further files, including a decoy PDF and a BAT downloader. The BAT installs Python packages and registers pythonw.exe in Task Scheduler, which runs a Python backdoor that executes attacker commands.

Type F: OLE objects embedded in HWP (Hangul Word Processor) documents carry attachment links. Opening a link writes object files to %TEMP% and launches a legitimate tool that loads a malicious version.dll by DLL side-loading, followed by BAT scripts and a PowerShell backdoor.

The report lists five MD5 hashes and five C2/download URLs across cwmodern.com, dolgicap.com and dpaper.dothome.co.kr. AhnLab detection names are Backdoor/Python.Agent, Downloader/BAT.Agent, Dropper/LNK.Generic, Trojan/LNK.Agent, Trojan/PowerShell.Agent, Trojan/VBS.Agent and Trojan/HWP.Agent. The article states no CVEs and no attribution. The related July 2026 report likewise names no group, uses the same Type A-F taxonomy, and cites GitHub, Google Drive, Dropbox and PubNub as infrastructure. Severity is an analyst assessment.

## MITRE ATT&CK

- T1566.001 Spearphishing Attachment
- T1204.002 Malicious File
- T1059.001 PowerShell
- T1059.003 Windows Command Shell
- T1059.005 Visual Basic
- T1059.006 Python
- T1059.010 AutoHotKey & AutoIT
- T1053.005 Scheduled Task
- T1218.005 Mshta
- T1036.004 Masquerade Task or Service
- T1574.001 DLL
- T1055 Process Injection
- T1140 Deobfuscate/Decode Files or Information
- T1102.002 Bidirectional Communication
- T1082 System Information Discovery
- T1056.001 Keylogging

## Sources

- [AhnLab ASEC: August 2026 APT Attack Trends Report (Domestic)](https://asec.ahnlab.com/ko/95648/)
- [AhnLab ASEC: July 2026 Threat Trend Report on APT Attacks (South Korea)](https://asec.ahnlab.com/en/95171/)
- [AhnLab ASEC: June 2026 Threat Trend Report on APT Attacks (South Korea)](https://asec.ahnlab.com/en/94594/)
- [AhnLab ASEC: May 2026 Threat Trend Report on APT Attacks (South Korea)](https://asec.ahnlab.com/en/94271/)
- [AhnLab ASEC: April 2026 Threat Trend Report on APT Attacks (South Korea)](https://asec.ahnlab.com/en/93831/)
- [AhnLab ASEC: March 2026 APT Attack Trends Report (Domestic)](https://asec.ahnlab.com/en/93467/)
- [AhnLab ASEC: Malicious LNK Files Distributing a Python-Based Backdoor (Kimsuky Group) - related prior reporting](https://asec.ahnlab.com/en/tag/backdoor-en)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2800