July 2026 Threat Trend Report on APT Attacks (South Korea)
During July 2026, multiple APT campaigns targeted entities in South Korea primarily through spear phishing attacks utilizing LNK files. Seven distinct attack types (A through G) were identified, each employing different techniques including PowerShell scripts, AutoIt programs, curl.exe downloads, and DLL side-loading. Attackers distributed malware through platforms like GitHub, Google Drive, and Dropbox, often disguised as legitimate documents or resumes. These campaigns deployed backdoors, infostealers, keyloggers, and XenoRAT malware to exfiltrate system information, credentials, virtual asset data, and maintain persistent access through Task Scheduler entries. Communications occurred via PubNub channels with data encoded in Base64. The attacks primarily began with phishing emails containing work-related content designed to deceive specific victims into executing malicious files.
Indicators of Compromise
- hash: 0080cd81db3244b8ba157ffabc1d30fe
- hash: 00f7955410783941d527afc12908556a
- hash: 029628bd99899c750d5537ee637fe3ca
- hash: 03a830875abc607aa30a621eb84697c8
- hash: 09bd2f48fcd29a0ed46b099c4d939024
July 2026 Threat Trend Report on APT Attacks (South Korea)
Description
During July 2026, multiple APT campaigns targeted entities in South Korea primarily through spear phishing attacks utilizing LNK files. Seven distinct attack types (A through G) were identified, each employing different techniques including PowerShell scripts, AutoIt programs, curl.exe downloads, and DLL side-loading. Attackers distributed malware through platforms like GitHub, Google Drive, and Dropbox, often disguised as legitimate documents or resumes. These campaigns deployed backdoors, infostealers, keyloggers, and XenoRAT malware to exfiltrate system information, credentials, virtual asset data, and maintain persistent access through Task Scheduler entries. Communications occurred via PubNub channels with data encoded in Base64. The attacks primarily began with phishing emails containing work-related content designed to deceive specific victims into executing malicious files.
Technical Details
- Author
- AlienVault
- Tlp
- white
- References
- ["https://asec.ahnlab.com/en/95171"]
- Adversary
- Kimsuky
- Pulse Id
- 6a91687da8e6cd5cc16f64a6
- Threat Score
- null
Indicators of Compromise
Hash
| Value | Description | Copy |
|---|---|---|
hash0080cd81db3244b8ba157ffabc1d30fe | — | |
hash00f7955410783941d527afc12908556a | — | |
hash029628bd99899c750d5537ee637fe3ca | — | |
hash03a830875abc607aa30a621eb84697c8 | — | |
hash09bd2f48fcd29a0ed46b099c4d939024 | — |
Threat ID: 6a91bde9acd9273b491c5a8f
Added to database: 08/28/2026, 16:57:13 UTC
Last updated: 08/28/2026, 17:41:41 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.