6 minhigh
August 2026 Threat Trend Report on APT Attacks (South Korea)
Multiple APT attack variants targeting South Korea use spear-phished LNK files to deploy backdoors, infostealers, and XenoRAT via PowerShell, AutoIt, and DLL side-loading. Six attack types (A-F) deliver malware via spear phishing using LNK and HWP files. Persistence is achieved through Task Scheduler entries disguised as legitimate updates. Final payloads include Python backdoors, keyloggers, infostealers, and XenoRAT, with C2 via PubNub channels and data exfiltration encoded in Base64.
Sens:▲ 24hConf:medium
IOCs12
5md55url2filename
Detection / Hunteropenrouter
Immediate Actions
defender takeaway
- Block listed malicious URLs at network perimeter and proxy
- Hunt for Task Scheduler entries mimicking OneDrive updates
- Quarantine systems with matching MD5 hashes
- Search for sys.Dll and version.Dll in %TEMP% and C:\ProgramData
Key Takeaways
- LNK files accounted for the highest proportion of APT delivery in August 2026
- Type A uses PubNub channel for C2 communication and Base64 for exfiltration
- Types D and F employ DLL side-loading to inject backdoors into legitimate processes
- Type C distributes XenoRAT malware via GitHub repositories
- Type E disguises pythonw.exe and uses a Python backdoor for remote command execution
Attack Chain
- Initial Access: Spear phishing emails deliver LNK files or HWP documents to targets
- Execution: LNK files execute embedded PowerShell, CMD, or AutoIt scripts
- Persistence: Task Scheduler entries created disguised as OneDrive updates or legitimate processes
- Defense Evasion: DLL side-loading injects backdoors into legitimate processes
- C2: Commands received via PubNub channels or external URLs; data exfiltrated as Base64
- Exfiltration: System info, important files, and virtual asset data stolen via backdoors and infostealers
Affected Systems
- Windows systems (all attack types use Windows-native tools and paths)
- Hangul HWP document users (Type F uses OLE objects in HWP files)
- Users targeted by spear phishing emails with LNK or HWP attachments
Detection Availability
No detection rules or queries are published in the source article.
Detection Engineering Assessment
Hypotheses are starting points derived from the article, not findings about your environment; validate against your own telemetry.
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Medium | LNK execution, PowerShell, and Task Scheduler creation are visible to EDR. |
| Network Visibility | Medium | C2 over PubNub and HTTP blends with legitimate API traffic; some URLs are clear indicators. |
| Detection Difficulty | Hard | Multiple variants abuse legitimate tools (curl.exe, pythonw.exe) and DLL side-loading for evasion. |
Hunting Hypotheses
| Hypothesis | Telemetry | Stage | FP Risk |
|---|---|---|---|
| LNK files spawning PowerShell or CMD with Base64-encoded commands (T1059.001, T1027) | Process creation with parent .lnk and encoded args | Execution | Low — LNK-to-PowerShell is rare in normal use |
| Task Scheduler entries created with names mimicking OneDrive updates (T1053.005, T1036.004) | Scheduled task creation events with update-like names | Persistence | Medium — legitimate update tasks may match naming patterns |
| curl.exe copied to and executed from %TEMP% to download remote content (T1105) | Process execution of curl.exe from non-standard paths | Ingress Tool Transfer | Low — curl from %TEMP% is atypical |
| DLL files loaded from %TEMP% or C:\ProgramData by legitimate executables (T1574.002) | Image load events showing DLLs from non-standard paths | Defense Evasion | Medium — some installers load DLLs from temp |
Required Log Sources
- Process creation events (Sysmon EID 1)
- Scheduled task creation events (EID 4698)
- Image load events (Sysmon EID 7)
- Network connection events (Sysmon EID 3)
- File creation events (Sysmon EID 11)
- Email gateway logs
Key Behavioral Indicators
- LNK files spawning PowerShell with Base64-encoded command arguments
- curl.exe copied to and executed from %TEMP% directory
- Task Scheduler entries named to mimic OneDrive updates
- pythonw.exe registered in Task Scheduler from non-standard paths
- DLL loading from %TEMP% or C:\ProgramData by legitimate executables
- HWP documents with embedded OLE objects triggering process creation in %TEMP%
Control Gaps
- Legitimate tool abuse (curl.exe, pythonw.exe) bypasses application allowlisting
- PubNub C2 traffic blends with legitimate API traffic
- DLL side-loading from %TEMP% evades path-based allowlisting rules
- LNK file attachments may bypass email gateway file type filters
False Positive Assessment
Medium — Legitimate tools like curl.exe and pythonw.exe are common in enterprise environments; DLL side-loading detection may generate noise.
Recommendations
Suggestions to evaluate against your own environment, tooling, and incident-response procedures — not directives.
Infrastructure Hardening
- Block PubNub API traffic from non-application endpoints
- Restrict outbound connections to GitHub and Google Drive for non-developer systems
- Enable DLL search order verification for applications in %TEMP%
- Filter LNK and HWP attachments at email gateway
User Protection
- Update V3 antivirus to latest signature version
- Patch operating systems and web browsers
- Disable OLE object execution in HWP documents
- Monitor for pythonw.exe running from non-standard paths
Security Awareness
- Train employees to verify sender identity before opening attachments
- Instruct users to report suspicious LNK files received via email
- Warn about spear phishing emails containing resume-themed lures
MITRE ATT&CK Mapping
MITRE ATT&CK Mapping14 techniques
Tactic
Initial Access
Tactic
Stealth
Tactic
Credential Access
Tactic
Collection
Tactic
Command and Control
Plain-Language Summary
Hackers sent targeted phishing emails to organizations in South Korea containing malicious shortcut files. When opened, these files download and run hidden programs that steal information and give attackers remote control of computers. The attacks use multiple methods including disguised update tasks and legitimate software tools to avoid detection. Organizations should train employees to avoid opening files from unknown senders and keep security software updated.
Additional IOCs
- Urls:
hxxp://www[.]cwmodern[.]com/include/inc/_src/contents.php- Base C2 URL for malware download and communicationhxxp://www[.]cwmodern[.]com/include/inc/_src/contents.php?bbs=17- C2 URL variant with board parameter
- Command Lines:
- Purpose: Execute embedded PowerShell commands from LNK file to decode and run payloads | Tools:
powershell.exe,cmd.exe| Stage: Execution |powershell -enc - Purpose: Download malicious HTA file using native curl.exe | Tools:
curl.exe| Stage: Ingress Tool Transfer |curl.exe -o %TEMP% - Purpose: Register malicious script as scheduled task disguised as OneDrive update | Tools:
schtasks.exe| Stage: Persistence |schtasks /create /tn <taskname> /tr
- Purpose: Execute embedded PowerShell commands from LNK file to decode and run payloads | Tools:
Showing defanged values
- filenamesys.DllType B downloader DLL loading infostealers and backdoors into memory
- filenameversion.DllType F malicious DLL loaded via DLL side-loading alongside legitimate tool
- md50099bf67cfa72030c1c317240441f3b8Malware sample hash from August 2026 APT campaign
- md501e099f0947d0ef7bcb967063d761fa6Malware sample hash from August 2026 APT campaign
- md502f87ffe09edad431746660b310956c5Malware sample hash from August 2026 APT campaign
- md503be987cd4c4e1e788f803ca6e464a29Malware sample hash from August 2026 APT campaign
- md506b3b6fbf106d46534459d2189aac739Malware sample hash from August 2026 APT campaign
- urlhxxps://dpaper[.]dothome[.]co[.]kr/choijaa/?nonce=xPDi&fpt=WXNwam5PSnUwN3hpZkw0eQ==&fsz=39936Malware download URL with Base64-encoded parameters
- urlhxxp://www[.]cwmodern[.]com/include/inc/_src/contents[.]phpBase C2 URL for malware download and communication
- urlhxxp://www[.]cwmodern[.]com/include/inc/_src/contents[.]php?bbs=17C2 URL variant with board parameter
- urlhxxp://www[.]cwmodern[.]com/include/inc/_src/contents[.]php?contents=bk6EJpIGNzp1Ez9sO&board=0MLCHR8dbWwo8VO08axcBSqQ8R3nABdvC2 URL with encoded parameters for malware download
- urlhxxp://www[.]dolgicap[.]com/bbs/data/gongi/boardquery[.]php?query=lHg8pVCYNQ8HT8JP0aDgQ&number=PlI2C9VDvYsEQxf7t9Di7cHAjUnHtPFQGqVC2 URL with encoded parameters for malware download