CampaignPublished 3 Apr 2026

DPRK-Related Campaigns with LNK and GitHub C2

Source AlienVault OTX General

South Korea

Description

FortiGuard Labs recently detected a series of LNK files targeting users in South Korea. These attacks use a multi-stage scripting process and leverage GitHub as Command and Control (C2) infrastructure to evade detection. Although these LNK files can be traced back to 2024, earlier versions had less obfuscation and contained significant metadata, allowing us to track similar attacks spreading the XenoRAT malware.

Impact

The campaign enables attackers to execute multi-stage scripts via malicious LNK files, potentially leading to the deployment of XenoRAT malware on victim systems. This could result in unauthorized remote access and data compromise. The use of GitHub as C2 infrastructure complicates detection and mitigation efforts. However, there are no reports of widespread exploitation or active incidents beyond the detection of these files.

Defensive guidance

No official patches or fixes are available for this campaign. Organizations should monitor for the identified LNK file hashes and suspicious use of GitHub repositories as C2 channels. Employ endpoint protection solutions capable of detecting malicious LNK files and multi-stage scripting attacks. User awareness training to avoid opening suspicious shortcut files is recommended. Since this is a campaign rather than a software vulnerability, remediation focuses on detection and prevention rather than patching.

Summary

This campaign involves malicious LNK shortcut files used in attacks targeting South Korean users. The attackers use a multi-stage scripting process and leverage GitHub repositories as C2 infrastructure, which helps evade traditional detection mechanisms. Historical analysis shows earlier versions of these LNK files had less obfuscation and included metadata that linked them to the distribution of XenoRAT malware. The campaign is attributed to DPRK-related actors and has been observed since 2024.

Indicators of compromise

Hashes 5

484a16d779d67c7339125ceac10b9abf1aa47f561f40058789bfe2acda548282
9c3f2bd300ad2ef8584cc48adc47aab61bf85fc653d923e106c73fc6ec3ea1dc
af0309aa38d067373c54b2a7774a32f68ab72cb2dbf5aed74ac784b079830184
c0866bb72c7a12a0288f434e16ba14eeaa35d3c4cff4a86046c553c15679c0b5
f20fde3a9381c22034f7ecd4fef2396a85c05bfd54f7db3ad6bcd00c9e09d421

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 3 Apr 2026, 17:15 UTC

Technical details

Indicators of compromise

Hashes 5

Community reviews