Overview

AhnLab monitored APT (Advanced Persistent Threat) attacks targeting entities in Korea using its own infrastructure. This report summarizes the classification, statistics, and functional characteristics for each type of domestic APT attacks identified during the month of July 2026.

Trends of APT Attacks in South Korea

Most APT attacks detected in South Korea were distributed via spear phishing (a targeted form of phishing aimed at specific individuals or groups). In particular, attacks utilizing LNK files accounted for the highest proportion in July 2026.

Spear Phishing-Based Types

• Type A involves a PowerShell script embedded within an LNK file that extracts HEX data to restore and execute a legitimate decoy document, a legitimate AutoIt program, and a malicious AutoIt script. It executes the malicious script in the C:\ProgramData Path and registers a Task Scheduler entry that is disguised as a OneDrive update to ensure persistence. It then receives commands through a PubNub channel and exfiltrates the results by encoding them in Base64.
• Type B uses curl.Exe, a native Windows tool, to download and execute a malicious HTA file to %TEMP%. It is distributed through a GitHub repository or Google Drive operated by the threat actor and generates a decoy file and a downloader with the file name sys.Dll. This downloader loads Infostealers, keyloggers, and backdoors into memory to exfiltrate system information, lists of key files, and information related to virtual assets.
• Type C executes Base64-encoded data created in %temp% using PowerShell code embedded in an LNK file. It then downloads and executes decoy files and additional malicious scripts from a GitHub repository and creates a Task Scheduler entry. As a result, it exfiltrates system information and deploys XenoRAT-type malware.
• Type D restores legitimate documents, XML files, JavaScript files, and PowerShell scripts hidden inside the LNK file. It registers a Task Scheduler disguised as a browser update to periodically execute malicious scripts, collects information such as the username, operating system, public IP address, and a list of running processes, and transmits this data to Dropbox. It then downloads and executes a BAT file from Dropbox.
• Type E contains legitimate decoy files and malicious PowerShell commands within an LNK file that is disguised as a resume or document file. When the LNK is executed, it generates VBS, BAT, and PowerShell scripts, registers them with the Task Scheduler, and downloads and executes additional files from external URLs. It then executes a loader using the DLL side-loading technique and injects backdoor malware into a legitimate process.
• Type F uses CMD and PowerShell commands contained within an LNK file to download additional files. It copies curl.Exe to %TEMP%, then downloads and executes a decoy PDF document and a BAT downloader from an external URL. The BAT file installs a Python package and registers pythonw.Exe under a disguised name in the Task Scheduler. Finally, the Python backdoor performs command execution on the threat actor’s server and transmits the results.
• Type Unknown refers to cases distributed via spear phishing but not included in the types described above.

Additional Types Utilizing LNK

• Type G creates a malicious DLL file and a decoy file in the %ProgramData% path and uses regsvr32.Exe to load the DLL into memory. This DLL is backdoor malware capable of performing various malicious activities, such as Information Theft.

AhnLab Response Overview

The AhnLab product suite detects this malware using multiple detection names. The report explained that while past versions of this malware may have been detected, some variants of the threat currently being tracked may not yet be detected.

Conclusion

APT attacks targeting specific victims often began with phishing emails disguised as content likely to pique the user’s interest, such as work-related messages. The malware was distributed in various formats, such as executable files and shortcut files, and was primarily disguised as legitimate files. After infection, backdoors and Infostealers may be installed, enabling the exfiltration of PC data, the hijacking of System Control, and the uploading of additional malware. The report recommended verifying the sender’s identity, refraining from opening files from unknown sources, checking for vulnerable system settings, and applying the latest patches and updates for the OS, internet browsers, and V3.