September 2026 Threat Trend Report on APT Attacks (South Korea)

Content

AhnLab monitored APT (Advanced Persistent Threat) attacks targeting entities in Korea using its own infrastructure. This report summarizes the classification, statistics, and functional characteristics for each type of domestic APT attacks identified during the month of September 2026.

Purpose and Scope

The report outlines the distribution methods and execution types of APT attacks identified in Korea. Most of the attacks were identified as spear phishing (phishing targeting specific individuals or groups), with emails containing malicious attachments or links designed to trick users into opening them.

Key Statistics

• In September 2026, most of the APT attacks detected in Korea were carried out via spear phishing. – In particular, attacks utilizing LNK files accounted for the largest share. – The detected intrusion types were classified as Type A, Type B, Type C, Type Unknown, and Type D.

Type A

A PowerShell script embedded in the LNK file extracted HEX data based on specific markers (such as NCFO and BCFO) to restore and execute a legitimate decoy document, a legitimate AutoIt program, and a malicious AutoIt script file. While deceiving users by displaying legitimate documents, it executed malicious scripts in the C:\ProgramData Path and registered a Task Scheduler entry that was disguised as a OneDrive update to ensure persistence. The infected system received commands through a PubNub channel generated based on the computer name and username, and exfiltrated the results externally by encoding them in Base64.

Type B

The threat actor used curl.exe, a standard Windows tool, to download and execute a malicious HTA file in the %TEMP% folder. This HTA file was distributed through a GitHub repository or Google Drive operated by the threat actor, and it created a decoy file and a downloader with the file name sys.dll. This downloader loaded into memory Infostealer-type malware—which exfiltrates system information, lists of key files, and information related to virtual assets—as well as keyloggers and backdoors.

Type C

The PowerShell code embedded in the LNK file executed, creating and running Base64-encoded data on the %TEMP% path. The PowerShell script then connected to a GitHub repository, downloaded and executed a decoy file and additional malicious scripts, and created a Task Scheduler job. As a result, it exfiltrated system information and deployed XenoRAT-type malware.

Type Unknown

A case has been identified that was distributed through spear phishing but does not fall under any of the previous categories. Multiple LNK files were used, and decoy files were employed to make them appear as legitimate files.

Type D

After creating a malicious DLL file and a decoy document in the ‘%ProgramData%’ directory, the attacker loaded the DLL into memory using regsvr32.exe, a legitimate Windows tool. This DLL is a backdoor malware capable of performing various malicious activities, such as Information Theft.

Conclusion

Many of these recent domestic APT attacks began with phishing emails disguised as work-related correspondence, and the malicious files—such as executable files and shortcut files—were disguised as legitimate files in various formats. If an attack is successful, backdoors and Infostealers may be installed, leading to the leakage of PC information, the hijacking of System Control, and the upload of malware. Since there may be numerous unconfirmed attacks not described in this report, it is essential to verify the sender’s identity, refrain from opening files from unknown sources, check for vulnerable system settings, apply the latest patches for your OS and web browser, and keep V3 updated to the latest version.