September 2026 Threat Trend Report on APT Attacks (South Korea)

In September 2026, multiple advanced persistent threat (APT) campaigns targeted South Korean organizations using spear phishing emails. The attacks employed various techniques such as LNK files with embedded PowerShell scripts, HTA files downloaded via curl.exe, and malicious DLLs. Five attack types were identified, deploying AutoIt scripts, infostealers, keyloggers, backdoors including XenoRAT, and persistence via Task Scheduler. Attackers used legitimate platforms like GitHub, Google Drive, and PubNub for command and control. Malicious files were disguised as legitimate documents to deceive victims and exfiltrate system information, credentials, and virtual asset data while maintaining persistent access.

• August 2026 Threat Trend Report on APT Attacks (South Korea)Malware2026-10-02
• Konni Hackers Target Ukraine With Malicious LNK Files and VelvetCake PowerShell MalwareMalware2026-09-24
• Kimsuky attacks targeting Ukrainian experts in diplomacy, security, and international policyCampaign2026-10-13
• Appraisal by AI: Model-driven victim prioritization in the VOLTA infostealerMalware2026-10-31
• SEO Poisoning Campaign Targets DeepSeek Users: Chinese Threat Actor Deploys Kong RAT via Multi-Stage AttacksMalware2026-10-29