During August 2026, South Korean organizations were targeted by multiple APT campaigns primarily via spear phishing attacks leveraging LNK files. Six attack types were observed: Type A used HEX data extraction with PubNub command and control; Type B used curl.exe to download HTA files from GitHub and Google Drive, deploying infostealers and keyloggers; Type C distributed XenoRAT malware via GitHub repositories; Type D employed resume-themed lures with VBS, BAT, and PowerShell scripts for backdoor injection; Type E used Python-based backdoors disguised as pythonw.exe executables; and Type F exploited Hangul documents with embedded OLE objects for malicious DLL loading. The attacks focused on stealing information, hijacking system control, and deploying further malware.

The campaigns resulted in information theft, unauthorized system control, and additional malware infections on targeted South Korean entities. The use of multiple sophisticated techniques and malware families indicates a significant risk to confidentiality and system integrity for affected organizations.

No official patch or remediation is indicated. Organizations should apply targeted defenses against spear phishing and LNK file exploitation, including user awareness training, disabling or restricting execution of LNK files from untrusted sources, monitoring for suspicious PowerShell and script activity, and blocking known malicious domains and file hashes as indicators of compromise. Refer to the vendor advisory at https://asec.ahnlab.com/en/95649 for further guidance.