July 2026 Threat Trend Report on APT Attacks (South Korea)

This report details multiple advanced persistent threat (APT) campaigns active in July 2026 targeting organizations in South Korea. Attackers used spear phishing emails containing LNK files to initiate infection. Seven different attack variants (A through G) utilized diverse techniques including PowerShell execution, AutoIt scripting, DLL side-loading, and downloading components via curl.exe. Malware delivery leveraged popular cloud platforms such as GitHub, Google Drive, and Dropbox, often masquerading as legitimate files like resumes or documents. The deployed malware families included backdoors, infostealers, keyloggers, and XenoRAT, enabling credential theft, system information gathering, virtual asset data exfiltration, and persistent access through scheduled tasks. Command and control communications were conducted over PubNub channels with Base64 encoding to evade detection. The campaigns primarily relied on social engineering via work-related spear phishing to trick targets into executing malicious files.

The campaigns resulted in unauthorized access to targeted systems, theft of credentials and sensitive system information, exfiltration of virtual asset data, and establishment of persistent backdoors. This compromises confidentiality and integrity of affected organizations' data and systems. The use of multiple malware types and persistence mechanisms increases the difficulty of detection and remediation.

No specific patch or official fix is applicable as this is a threat actor campaign rather than a software vulnerability. Organizations should enhance phishing detection and user awareness training focused on spear phishing and malicious LNK files. Monitoring for unusual Task Scheduler entries and network communications to PubNub channels may help detect infections. Restricting execution of unauthorized scripts and binaries such as PowerShell and AutoIt, and controlling use of cloud storage platforms for downloads can reduce risk. Incident response should focus on identifying and removing deployed malware and backdoors.