# AhnLab ASEC September 2026 Domestic APT Trend Report - Spear-Phishing LNK/HTA/regsvr32 Chains Delivering XenoRAT, AutoIt Backdoors, Infostealer and Keylogger Against South Korea

> AhnLab ASEC's September 2026 domestic (South Korea) APT report documents five spear-phishing attack types: LNK files with embedded PowerShell restoring AutoIt payloads with PubNub C2, curl.exe-downloaded HTA files, Base64 PowerShell fetching XenoRAT from GitHub, and DLL backdoors loaded via regsvr32.exe. Most chains use decoy documents and Task Scheduler persistence; attribution is not stated in the report.

- **Published:** 2026-10-30T10:38:20Z
- **Last reviewed:** 2026-10-30T10:38:20Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4819
- **ID:** TL-2026-4819
- **Severity:** HIGH
- **Category:** APT
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 17 (full data via the Threadlinqs MCP server — Purple tier)

## Description

AhnLab Security Intelligence Center (ASEC) published its monthly trend report on APT attacks observed in South Korea during September 2026 on 2026-10-30. The report groups the observed activity into four named attack types plus an unclassified set, all started by spear phishing with malicious attachments or links, with Windows shortcut (LNK) files as the dominant initial payload.

Type A: an LNK file embeds a PowerShell script that locates HEX-encoded data inside the LNK using the markers NCFO and BCFO and restores a legitimate-looking decoy document, a legitimate AutoIt interpreter and a malicious AutoIt script. Persistence is a Task Scheduler entry disguised as a OneDrive update. The AutoIt malware communicates with PubNub channels named from the computer and user name, with Base64-encoded traffic.

Type B: the Windows native curl.exe downloads a malicious HTA file into %TEMP%; the HTA is hosted on GitHub repositories or Google Drive. It drops a downloader named sys.dll and subsequently loads an infostealer, a keylogger and a backdoor into memory.

Type C: PowerShell inside an LNK writes Base64-encoded data into %temp%, then reaches out to GitHub to download and run a payload and creates a scheduled task. The final payload is XenoRAT, which exfiltrates system information.

Type D: a malicious DLL and a decoy document are created in %ProgramData%, and the DLL is loaded into memory with regsvr32.exe. The DLL is a backdoor that supports credential theft and remote control of the system. An additional unclassified group consists of LNK files with decoy documents that do not fit the four types.

Published IOCs are five MD5 hashes, one IP (103.81.116.10) and five URLs on epaper.dothome.co.kr, link24.kr, corpsecs.com subdomains and an xo.je-hosted PHP endpoint. The report does not state attribution, scheduled task names or exact command lines. ASEC's earlier 2026 reports (April, June, July) describe the same families of chains; the July report's tags reference Kimsuky, but that is a tag on a different report and is not an attribution for this one, so attribution is left as Unknown/LOW. Severity is an analyst judgment; no CVEs or CVSS are stated.

## MITRE ATT&CK

- T1566 Phishing
- T1566.001 Phishing: Spearphishing Attachment
- T1566.002 Phishing: Spearphishing Link
- T1204.002 User Execution: Malicious File
- T1059.001 Command and Scripting Interpreter: PowerShell
- T1053.005 Scheduled Task/Job: Scheduled Task
- T1036.004 Masquerading: Masquerade Task or Service
- T1218.010 System Binary Proxy Execution: Regsvr32
- T1027 Obfuscated Files or Information
- T1132.001 Data Encoding: Standard Encoding
- T1056.001 Input Capture: Keylogging
- T1555 Credentials from Password Stores
- T1082 System Information Discovery

## Sources

- [2026년 9월 APT 공격 동향 보고서(국내) - AhnLab ASEC](https://asec.ahnlab.com/ko/96294/)
- [July 2026 Threat Trend Report on APT Attacks (South Korea) - AhnLab ASEC](https://asec.ahnlab.com/en/95171/)
- [June 2026 Threat Trend Report on APT Attacks (South Korea) - AhnLab ASEC](https://asec.ahnlab.com/en/94594/)
- [April 2026 Threat Trend Report on APT Attacks (South Korea) - AhnLab ASEC](https://asec.ahnlab.com/en/93831/)
- [March 2026 APT Attack Trends Report (Domestic) - AhnLab ASEC](https://asec.ahnlab.com/en/93467/)
- [September 2025 APT Attack Trends Report (South Korea) - AhnLab ASEC](https://asec.ahnlab.com/en/90714/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4819