AhnLab monitored multiple APT attack campaigns in South Korea during June 2026, conducted by the Kimsuky threat actor. The attacks were delivered mainly through spear phishing emails containing malicious LNK files masquerading as legitimate work-related documents. Six attack vectors were identified, leveraging techniques such as malicious PowerShell execution, AutoIt-based malware, misuse of curl.exe, exploitation of GitHub repositories, persistence via Task Scheduler, DLL side-loading, and Python backdoors. The malware families involved included infostealers, keyloggers, backdoors, and RATs like XenoRAT. These campaigns established persistence on victim systems, exfiltrated sensitive information, and allowed remote adversary control. Indicators include specific file hashes and malicious domains. No known exploits in the wild or patches are applicable as this is a threat actor campaign rather than a software vulnerability.

The attacks result in unauthorized access to targeted systems, enabling data exfiltration, credential theft, and remote control by threat actors. Compromised systems may be used for espionage or further malicious activities. The use of multiple sophisticated techniques increases the difficulty of detection and mitigation. The impact is primarily on organizations in South Korea targeted by these campaigns.

No official patch or fix applies as this is a threat actor campaign rather than a software vulnerability. Organizations should verify the authenticity of email senders, avoid opening files from unknown or untrusted sources, especially LNK files, and maintain updated antivirus and endpoint protection solutions. Applying security patches to operating systems and software reduces the risk of exploitation of known vulnerabilities used in conjunction with these attacks. User awareness training on spear phishing threats is recommended.