This campaign involves malicious LNK shortcut files used in attacks targeting South Korean users. The attackers use a multi-stage scripting process and leverage GitHub repositories as C2 infrastructure, which helps evade traditional detection mechanisms. Historical analysis shows earlier versions of these LNK files had less obfuscation and included metadata that linked them to the distribution of XenoRAT malware. The campaign is attributed to DPRK-related actors and has been observed since 2024. No CVE or patch information is available, and no known exploits in the wild have been reported.

The campaign enables attackers to execute multi-stage scripts via malicious LNK files, potentially leading to the deployment of XenoRAT malware on victim systems. This could result in unauthorized remote access and data compromise. The use of GitHub as C2 infrastructure complicates detection and mitigation efforts. However, there are no reports of widespread exploitation or active incidents beyond the detection of these files.

No official patches or fixes are available for this campaign. Organizations should monitor for the identified LNK file hashes and suspicious use of GitHub repositories as C2 channels. Employ endpoint protection solutions capable of detecting malicious LNK files and multi-stage scripting attacks. User awareness training to avoid opening suspicious shortcut files is recommended. Since this is a campaign rather than a software vulnerability, remediation focuses on detection and prevention rather than patching.