August 2025 APT Attack Trends Report

In August 2025, APT attacks in South Korea primarily utilized spear phishing techniques, with LNK files being the most prevalent method. Two main types of attacks were observed: Type A, which used compressed CAB files containing malicious scripts for information exfiltration and additional malware downloads, and Type B, which executed RAT malware like XenoRAT and RoKRAT using Dropbox API or Google Drive. The attacks targeted various sectors, employing sophisticated social engineering tactics and decoy documents to increase credibility. The malware performed actions such as keylogging, taking screenshots, and executing commands based on the threat actor's instructions. The report highlights the continuous evolution of APT tactics and the importance of vigilance against targeted phishing campaigns.

• August 2026 Threat Trend Report on APT Attacks (South Korea)Malware2026-10-02
• Kimsuky attacks targeting Ukrainian experts in diplomacy, security, and international policyCampaign2026-10-13
• Konni Hackers Target Ukraine With Malicious LNK Files and VelvetCake PowerShell MalwareMalware2026-09-24
• In Other News: Tor Exit Relays Hijacked, Banks Spot Rogue AI Agents, Self-Rebuilding macOS RansomwareAnalysis2026-10-23
• AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromiseCampaign2026-10-21