MalwarePublished 26 Jan 2026Updated 25 Feb 2026

Malware MoonPeak Executed via LNK Files

Source AlienVault OTX General

Description

In January 2026, IIJ observed malicious LNK files targeting Korean users to execute the MoonPeak malware, attributed to North Korean threat actors. The infection chain begins with a LNK file that runs an obfuscated PowerShell script, which checks for analysis environments, creates additional scripts, and sets up persistence. The second stage downloads and executes a payload from GitHub, which is actually the MoonPeak malware. MoonPeak is obfuscated using ConfuserEx and communicates with a C2 server. The campaign utilizes GitHub for hosting malware, a technique known as Living Off Trusted Sites (LOTS). This attack demonstrates the ongoing threat posed by North Korean actors targeting various countries and individuals worldwide.

Impact

For European organizations, the MoonPeak malware campaign presents a significant risk due to its stealthy infection vector and use of trusted platforms for payload delivery. If successful, the malware can establish persistence, enabling long-term access to compromised systems, potentially leading to espionage, data theft, or disruption of operations. The use of obfuscated PowerShell scripts and LOTS techniques complicates detection by traditional antivirus and network security tools. European organizations with Windows environments that allow execution of LNK files and PowerShell scripts are vulnerable, especially if users are not trained to recognize suspicious files or if endpoint protections are insufficient. The campaign’s reliance on GitHub for hosting payloads may bypass some network filtering rules, increasing the likelihood of successful payload delivery. The medium severity rating reflects the need for user interaction and the absence of zero-day exploits, but the persistence and stealth capabilities increase the potential impact on confidentiality and integrity of sensitive data. Additionally, the geopolitical context of North Korean threat actors targeting global victims suggests that critical infrastructure, government entities, and industries with strategic importance in Europe could be targeted for espionage or disruption.

Defensive guidance

1. Implement strict email and endpoint filtering to block or quarantine LNK files and other suspicious attachments, especially from unknown or untrusted sources. 2. Enforce application whitelisting policies that restrict execution of PowerShell scripts and LNK files unless explicitly authorized. 3. Enable PowerShell logging and monitor for obfuscated or suspicious script execution patterns to detect early signs of infection. 4. Use endpoint detection and response (EDR) solutions capable of identifying LOTS techniques and anomalous GitHub traffic related to malware downloads. 5. Educate users about the risks of opening unsolicited shortcut files and the importance of verifying file origins. 6. Restrict or monitor outbound network connections to GitHub repositories that are not business-critical, and consider implementing network segmentation to limit lateral movement. 7. Regularly update and patch systems to reduce the attack surface, and conduct threat hunting exercises focusing on persistence mechanisms such as registry run keys and scheduled tasks. 8. Employ multi-factor authentication and least privilege principles to limit the impact if credentials are compromised. 9. Collaborate with threat intelligence providers to stay updated on emerging indicators of compromise (IOCs) related to MoonPeak and similar threats. 10. Conduct regular backups and verify recovery procedures to mitigate potential data loss or ransomware scenarios linked to persistent malware presence.

Indicators of compromise

IP addresses 1

27.102.137.88

Hashes 8

640f54bb6d29d98d92344136fee49d07
ea5d9be286f7af423c070128af170085
665a1cdb7f050816dcb7b90a5516f2a38613e281
d8e96e777de3234e0771e6c53b7c09a659542f12
ebec41675fff24858ad558429ce4e4e32c30da55
1553bfac012b20a39822c5f2ef3a7bd97f52bb94ae631ac1178003b7d42e7b7f
8de36cb635eb87c1aa0e8219f1d8bf2bb44cad75b58ef421de77dd1aae669bf4
aaac6eadac6c325bfc69b561d75f7cfd979ac289de1cc4430c5cc9a9a655b279

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 26 Jan 2026, 18:07 UTC

MITRE ATT&CK techniques12 from threat tags

Technical details

Indicators of compromise

IP addresses 1

Hashes 8

Community reviews

Related threats