Analysis of a Phishing Email Attack Case

The Larva-24009 threat actor, also known as HeptaX, has been conducting phishing email campaigns since 2023, targeting Korean and global users to install malware. Active through 2026, the actor uses LNK files disguised as documents with topics like hospital surveys, blockchain, project proposals, and resumes to target enterprises. Upon execution, obfuscated PowerShell commands deploy backdoors and download additional scripts from command-and-control servers. The attack chain includes persistence mechanisms via Task Scheduler, remote access through QuasarRAT and UltraVNC, and information theft using NirSoft tools, custom keyloggers, and screenshot capabilities. The actor also creates backdoor RDP accounts and exfiltrates credentials, browser data, and user files. Version 2.1 of their Notifier malware utilizes Telegram API for status reporting. The campaigns demonstrate consistent tactics and infrastructure across multiple years of operation.

• Case of AgentTesla Malware Distribution Disguised as a Business Proposal EmailMalware2026-10-14
• Hackers Use Fake ChatGPT Plus Billing Emails to Steal Credit Card Details and OTP CodesCampaign2026-11-02
• Appraisal by AI: Model-driven victim prioritization in the VOLTA infostealerMalware2026-10-31
• Black October for AI Developer PlatformsCampaign2026-10-31
• September 2026 Threat Trend Report on APT Attacks (South Korea)Malware2026-10-30