Content

AhnLab monitored domestic APT (Advanced Persistent Threat) attacks—which are conducted covertly and persistently—using its own infrastructure. This report summarizes the classification and statistics on domestic APT attacks identified in June 2026 and describes the capabilities of each type of APT attack.

Purpose and Scope

Most of the APT attacks identified in Korea were distributed via spear phishing (phishing targeting specific individuals or groups). Threat actors used file names and emails that appeared to be work-related documents to trick users into executing them, with attacks utilizing LNK files accounting for the highest proportion.

Key Statistics

• Type A used malicious PowerShell commands within a LNK file to connect to an external URL, download AutoIt malware, and register it in the Task Scheduler to ensure persistent execution. The AutoIt script performed functions such as command execution, directory querying, file uploading, and file downloading.
• Type B used curl.Exe (a default Windows tool) to download and execute a malicious HTA file in %TEMP%. It then created a downloader by downloading files through GitHub repositories or Google Drive, and loaded Infostealers, keyloggers, and backdoors into memory.
• Type C created and executed Base64-encoded data in %TEMP%, then downloaded decoy files and malicious scripts from a GitHub repository. It ensured persistence by disguising itself as a browser update through the Task Scheduler and distributed XenoRAT-type malware.
• Type D used XML, JS, and PowerShell scripts to register a Task Scheduler job; after transmitting system information externally, it executed a malicious Python script via a BAT file and a compressed file. Ultimately, a backdoor capable of executing remote commands and controlling files was activated.
• Type E included legitimate decoy files and malicious PowerShell commands within an LNK file that was disguised as a resume or document. It created VBS, BAT, and PowerShell scripts to establish persistence, executed a loader using the DLL side-loading technique, and injected the backdoor into a legitimate process.
• Type F is a variant that uses CMD and PowerShell commands to download additional files. It copied curl.Exe to %TEMP%, then executed a decoy PDF and a BAT downloader; it also disguised a Python package and pythonw.Exe, registered them in the Task Scheduler, and periodically executed a malicious Python backdoor.
• Type Unknown refers to cases distributed via spear phishing but not included in the preceding categories.

Conclusion

APT attacks targeting specific victims often began with phishing emails disguised as work-related communications. The distributed files were disguised as legitimate files in various formats, such as executables and shortcuts; once executed, they installed backdoors and Infostealers, which could lead to the leakage of PC information, the hijacking of System Control over infected systems, and the upload of malware. Since there may be unconfirmed attacks not included in this report, it is necessary to verify the sender, refrain from opening files from unknown sources, check for vulnerable system settings, apply the latest patches for the OS and web browsers, and keep V3 updated to the latest version.