Threat reportAPTTL-2026-4819
AhnLab ASEC September 2026 Domestic APT Trend Report - Spear-Phishing LNK/HTA/regsvr32 Chains Delivering XenoRAT, AutoIt Backdoors, Infostealer and Keylogger Against South Korea
AhnLab ASEC September 2026 Domestic APT Trend Report (TL-2026-4819) is a high-severity advanced persistent threat campaign, first published 2026-10-30. It has no confirmed attribution, affects Microsoft Windows (endpoints in South Korean organizations), maps to 13 MITRE ATT&CK techniques (T1027, T1036.004, T1053.005), and is covered by 9 detection rules and 17 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 13MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 17Indicators of compromise
Key facts for TL-2026-4819
- Threat ID
- TL-2026-4819
- Severity
- HIGH
- Status
- ACTIVE
- Category
- APT
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- ESPIONAGE
- Target sectors
- government administration, defense, academia, finance, cryptocurrency
- Target regions
- south korea
- Detection rules
- 9
- Indicators of compromise
- 17
Malware and tooling in AhnLab ASEC September 2026 Domestic APT Trend Report
Malware and tooling: Rakhni, XenoRAT, AutoIt
How AhnLab ASEC September 2026 Domestic APT Trend Report works
AhnLab ASEC's September 2026 domestic (South Korea) APT report documents five spear-phishing attack types: LNK files with embedded PowerShell restoring AutoIt payloads with PubNub C2, curl.exe-downloaded HTA files, Base64 PowerShell fetching XenoRAT from GitHub, and DLL backdoors loaded via regsvr32.exe. Most chains use decoy documents and Task Scheduler persistence; attribution is not stated in the report.
AhnLab Security Intelligence Center (ASEC) published its monthly trend report on APT attacks observed in South Korea during September 2026 on 2026-10-30. The report groups the observed activity into four named attack types plus an unclassified set, all started by spear phishing with malicious attachments or links, with Windows shortcut (LNK) files as the dominant initial payload.
Type A: an LNK file embeds a PowerShell script that locates HEX-encoded data inside the LNK using the markers NCFO and BCFO and restores a legitimate-looking decoy document, a legitimate AutoIt interpreter and a malicious AutoIt script. Persistence is a Task Scheduler entry disguised as a OneDrive update. The AutoIt malware communicates with PubNub channels named from the computer and user name, with Base64-encoded traffic.
Type B: the Windows native curl.exe downloads a malicious HTA file into %TEMP%; the HTA is hosted on GitHub repositories or Google Drive. It drops a downloader named sys.dll and subsequently loads an infostealer, a keylogger and a backdoor into memory.
Type C: PowerShell inside an LNK writes Base64-encoded data into %temp%, then reaches out to GitHub to download and run a payload and creates a scheduled task. The final payload is XenoRAT, which exfiltrates system information.
Type D: a malicious DLL and a decoy document are created in %ProgramData%, and the DLL is loaded into memory with regsvr32.exe. The DLL is a backdoor that supports credential theft and remote control of the system. An additional unclassified group consists of LNK files with decoy documents that do not fit the four types.
Published IOCs are five MD5 hashes, one IP (103.81.116.10) and five URLs on epaper.dothome.co.kr, link24.kr, corpsecs.com subdomains and an xo.je-hosted PHP endpoint. The report does not state attribution, scheduled task names or exact command lines. ASEC's earlier 2026 reports (April, June, July) describe the same families of chains; the July report's tags reference Kimsuky, but that is a tag on a different report and is not an attribution for this one, so attribution is left as Unknown/LOW. Severity is an analyst judgment; no CVEs or CVSS are stated.
MITRE ATT&CK techniques used in TL-2026-4819
Defense Evasion
T1027 Obfuscated Files or Information; T1036.004 Masquerading: Masquerade Task or Service; T1218.010 System Binary Proxy Execution: Regsvr32
Persistence
T1053.005 Scheduled Task/Job: Scheduled Task
Collection
T1056.001 Input Capture: Keylogging
Execution
T1059.001 Command and Scripting Interpreter: PowerShell; T1204.002 User Execution: Malicious File
Discovery
T1082 System Information Discovery
Command and Control
T1132.001 Data Encoding: Standard Encoding
Credential Access
T1555 Credentials from Password Stores
Initial Access
T1566 Phishing; T1566.001 Phishing: Spearphishing Attachment; T1566.002 Phishing: Spearphishing Link
Affected products and versions in AhnLab ASEC September 2026 Domestic APT Trend Report
- Microsoft — Windows (endpoints in South Korean organizations)
Vulnerable versions: Behavioral abuse of native tools; not version specific
Remediation for AhnLab ASEC September 2026 Domestic APT Trend Report
Immediate actions
- Block 103.81.116.10, epaper.dothome.co.kr, link24.kr, lutkdd.corpsecs.com, qykvdz.corpsecs.com and miej293-qk2insn-12nnsiw.xo.je at proxy/DNS/firewall
- Hunt for the five published MD5 hashes and for sys.dll created in user-writable paths
- Search for scheduled tasks masquerading as OneDrive updates or browser updates and for regsvr32.exe loading DLLs from %ProgramData%
- Quarantine LNK, HTA and archive attachments from untrusted senders in mail gateways
Workarounds
- Block LNK files and archives containing LNK files at the email gateway
- Set .hta files to open in a text editor or disable mshta.exe via application control
- Enable file-extension display so decoy documents with LNK extensions are visible to users
Longer-term hardening
- Deploy EDR with behavioral detection for LNK-spawned powershell.exe, curl.exe downloading .hta, and regsvr32.exe loading non-system DLLs
- Restrict or alert on curl.exe, mshta.exe and wscript.exe use by standard users
- Alert on outbound access to PubNub and raw GitHub/Google Drive content from non-developer endpoints
- Run phishing-awareness training focused on LNK and shortcut-in-archive lures
Timeline of AhnLab ASEC September 2026 Domestic APT Trend Report
- ASEC publishes its April 2026 APT trend report describing LNK/PowerShell AutoIt, PubNub, curl.exe HTA, and Base64 PowerShell XenoRAT chains against South Korea.
- ASEC publishes its June 2026 APT trend report with six attack types including XenoRAT disguised as browser updates and Python backdoors.
- ASEC publishes its July 2026 APT trend report with seven attack types, adding regsvr32.exe DLL loading from %ProgramData% and Dropbox exfiltration.
- Start of the September 2026 observation period covered by the ASEC domestic APT report (month-level coverage; exact first-seen dates are not given).
- End of the September 2026 observation window; spear-phishing campaigns A-D plus unclassified LNK decoy samples were observed in South Korea during the month.
- AhnLab ASEC publishes the September 2026 domestic APT attack trend report with five MD5 hashes, IP 103.81.116.10 and five URLs as IOCs.
Sources cited for AhnLab ASEC September 2026 Domestic APT Trend Report
- 2026년 9월 APT 공격 동향 보고서(국내) - AhnLab ASEC
- July 2026 Threat Trend Report on APT Attacks (South Korea) - AhnLab ASEC
- June 2026 Threat Trend Report on APT Attacks (South Korea) - AhnLab ASEC
- April 2026 Threat Trend Report on APT Attacks (South Korea) - AhnLab ASEC
- March 2026 APT Attack Trends Report (Domestic) - AhnLab ASEC
- September 2025 APT Attack Trends Report (South Korea) - AhnLab ASEC
Detection coverage for TL-2026-4819
As of 2026-10-30, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4819 across Splunk SPL, Microsoft KQL and Sigma, covering 17 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.
Community OSINT corroboration for TL-2026-4819
4 of this threat's indicators have also been reported by the open-source security community. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.