10 minhigh
July 2026 Threat Trend Report on APT Attacks (South Korea)
AhnLab identified multiple APT attack variants targeting South Korean entities in July 2026, primarily distributed via spear phishing using LNK files. Seven attack types were categorized, employing PowerShell, AutoIt, HTA, Python, and DLL side-loading techniques for execution and persistence. Threat actors abused legitimate platforms (GitHub, Google Drive, Dropbox, PubNub) for C2 and payload delivery, deploying backdoors, Infostealers, and XenoRAT to exfiltrate system data and establish remote control.
Sens:▲ 24hConf:medium
IOCs11
5md55url1file path
Detection / Hunteropenrouter
What Happened
Attackers sent targeted phishing emails to organizations in South Korea during July 2026. The emails contained shortcut files (LNK files) that, when opened, ran hidden scripts to install malicious software. The attackers used seven different methods, some involving PowerShell, Python, or AutoIt scripts, and disguised their malicious scheduled tasks as legitimate software updates. They used legitimate services like GitHub, Google Drive, and Dropbox to host and download additional malware. The installed malware allowed attackers to steal information and remotely control infected computers. Organizations should verify email senders, avoid opening attachments from unknown sources, and ensure their security software is up to date.
Key Takeaways
- APT attacks targeting South Korea in July 2026 predominantly used spear phishing with LNK files as the initial delivery vector.
- Seven distinct attack types (A-G) were identified, each using different combinations of PowerShell, AutoIt, HTA, Python, VBS, and DLL side-loading techniques.
- Persistence was consistently achieved via Task Scheduler entries disguised as legitimate software updates (OneDrive, browser updates).
- Threat actors abused legitimate infrastructure including GitHub, Google Drive, Dropbox, and PubNub for C2 communication and payload delivery.
- Multiple malware families were deployed including XenoRAT, Infostealers, keyloggers, and custom backdoors capable of data exfiltration and remote command execution.
Affected Systems
- Microsoft Windows (all versions supporting LNK files, PowerShell, Task Scheduler)
- Systems with AutoIt runtime installed
- Systems with Python installed (Type F)
Vulnerabilities (CVEs)
None identified.
Attack Chain
- Initial Access: Spear phishing email delivers LNK file disguised as resume or work-related document to target
- Execution: LNK file executes embedded PowerShell, CMD, or script commands to decode and run payloads from Base64 or HEX data
- Persistence: Malicious scripts register Task Scheduler entries disguised as OneDrive or browser updates
- Defense Evasion: Legitimate tools (curl.exe, regsvr32.exe, pythonw.exe) and DLL side-loading used to load malware into memory
- C2 and Exfiltration: Malware communicates via PubNub, Dropbox, GitHub, or attacker-controlled URLs to receive commands and exfiltrate stolen data
- Impact: Backdoors, Infostealers, keyloggers, and XenoRAT deployed for system control, data theft, and virtual asset information exfiltration
Detection Availability
- YARA Rules: No
- Sigma Rules: No
- Snort/Suricata Rules: No
- KQL Queries: No
- Splunk SPL Queries: No
- EQL Queries: No
- Other Detection Logic: No
- Platforms: AhnLab product suite (proprietary detection names)
The article states that AhnLab products detect this malware using multiple detection names but does not provide any publicly available detection rules. No YARA, Sigma, Snort, Suricata, or query-based detection logic is included in the report.
Detection Engineering Assessment
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Medium | EDR products should observe LNK file execution, PowerShell process spawning, scheduled task creation, and regsvr32 DLL loading. However, in-memory loading of payloads (Type B, Type G) and use of legitimate signed binaries may reduce visibility for some EDR vendors. |
| Network Visibility | Medium | Network telemetry would capture connections to attacker-controlled URLs and legitimate platforms (GitHub, Google Drive, Dropbox, PubNub). However, C2 over PubNub and Dropbox uses legitimate TLS connections, making traffic inspection less effective without SSL inspection or behavioral analysis. |
| Detection Difficulty | Moderate | The use of legitimate tools (curl.exe, regsvr32.exe, pythonw.exe) and legitimate cloud platforms for C2 complicates signature-based detection. Behavioral detection focusing on LNK-to-PowerShell execution chains, scheduled task creation with disguised names, and DLL side-loading patterns is feasible but requires tuning to reduce false positives. |
Required Log Sources
- Windows Security Event Log (Event ID 4688 - Process Creation)
- Windows Task Scheduler operational log
- PowerShell Script Block Logging (Event ID 4104)
- Sysmon Event ID 1 (Process Creation), Event ID 7 (Image Loaded), Event ID 11 (File Create)
- DNS resolution logs
- Proxy or web gateway logs
Hunting Hypotheses
| Hypothesis | Telemetry | ATT&CK Stage | FP Risk |
|---|---|---|---|
| Consider hunting for LNK files spawning PowerShell or CMD processes with encoded commands, as this is the primary execution pattern across multiple attack types described. | Process creation logs with parent-child relationship analysis, PowerShell Script Block Logging | Execution | Medium — legitimate administrative LNK files may invoke PowerShell, requiring baseline comparison |
| Consider hunting for scheduled task creation where the task name contains references to OneDrive updates or browser updates, as attackers used these disguises for persistence. | Windows Task Scheduler operational log, Sysmon Event ID 1 with schtasks.exe as the process | Persistence | Low to Medium — legitimate software updates may create similar tasks; verify the executing command path |
| Consider hunting for curl.exe executing from non-standard directories such as %TEMP%, as Type F attacks copy curl.exe to this location before downloading payloads. | Process creation logs, Sysmon Event ID 1 and Event ID 7 (image loaded from unexpected path) | Defense Evasion | Low — curl.exe executing from %TEMP% is atypical for legitimate software |
| Consider hunting for regsvr32.exe loading DLLs from %ProgramData%, as Type G attacks use this pattern to load backdoor DLLs into memory. | Process creation logs, Sysmon Event ID 7 (Image Loaded), file creation events in ProgramData | Execution | Low — legitimate software installations rarely load DLLs from ProgramData via regsvr32 |
| Consider hunting for pythonw.exe registered as a scheduled task under a disguised name, as Type F attacks use this technique for Python backdoor persistence. | Task Scheduler logs, process creation logs showing pythonw.exe execution | Persistence | Medium — legitimate Python-based scheduled tasks exist; verify the task name and script content |
Control Gaps
- Signature-based AV may miss in-memory loaded payloads (Type B, Type G) that do not write detectable files to disk
- Network controls without SSL inspection cannot inspect C2 traffic over PubNub, Dropbox, or GitHub TLS connections
- Allowlisting for legitimate tools (curl.exe, regsvr32.exe, pythonw.exe) may not flag their misuse for payload delivery and execution
- DNS-based blocking may not catch connections to compromised legitimate domains (jad.co.kr, dilmahshop.co.kr)
Key Behavioral Indicators
- LNK file as parent process spawning PowerShell or CMD with encoded command arguments
- Scheduled task creation with names referencing OneDrive or browser updates pointing to non-standard execution paths
- curl.exe copying itself to or executing from %TEMP% directory
- regsvr32.exe loading DLLs from C:\ProgramData\ path
- pythonw.exe registered as a scheduled task with a disguised name
- DLL file named sys.Dll created in ProgramData or TEMP directories
- PowerShell decoding and executing Base64 or HEX data from within LNK file metadata
False Positive Assessment
Medium — The attack patterns involve legitimate Windows tools (PowerShell, curl.exe, regsvr32.exe, Task Scheduler, pythonw.exe) and legitimate cloud platforms (GitHub, Dropbox, PubNub). Behavioral detections based on these tools and platforms will generate false positives in environments where they are used for legitimate administrative or development purposes. Tuning based on parent-child process relationships, execution paths, and task names is necessary to reduce noise.
Recommendations
Immediate Mitigation
defender takeaway
- Verify against your organization's incident response runbook and team escalation paths before acting. Consider blocking the identified malicious URLs at your web gateway or proxy if they are not legitimate business destinations.
- Consider searching endpoint telemetry for the five MD5 hashes listed in the report to identify potentially compromised hosts.
- If your EDR supports it, consider hunting for scheduled tasks with names referencing OneDrive or browser updates that point to non-standard script paths.
- Consider reviewing DNS logs for connections to fluxoras.site and the compromised Korean domains identified in the report.
Infrastructure Hardening
- Consider enabling PowerShell Script Block Logging and Constrained Language Mode to reduce the effectiveness of encoded PowerShell payloads.
- Evaluate whether Application Control or allowlisting solutions can restrict execution of scripts from %TEMP% and %ProgramData% directories.
- If supported by your email security platform, consider blocking or quarantining LNK file attachments from external senders.
- Consider implementing SSL inspection for outbound traffic to legitimate cloud platforms (GitHub, Dropbox, PubNub) if your organization's policies permit it, to improve C2 detection.
User Protection
- Consider deploying endpoint detection rules for regsvr32.exe loading DLLs from non-standard directories such as ProgramData.
- Evaluate whether your EDR can detect and alert on DLL side-loading attempts involving legitimate processes.
- Consider restricting the use of curl.exe and pythonw.exe to authorized administrative contexts if your organization does not require them for standard user workflows.
Security Awareness
- Consider reinforcing existing phishing awareness training with emphasis on not opening LNK files or unexpected attachments from external or unknown senders.
- Consider reminding users to verify sender identity through out-of-band channels before opening work-related document attachments.
- Consider incorporating guidance on recognizing spear phishing attempts disguised as resumes or work-related messages into existing awareness programs.
MITRE ATT&CK Mapping
MITRE ATT&CK Mapping13 techniques
Tactic
Initial Access
Tactic
Persistence
Tactic
Collection
Tactic
Command and Control
Tactic
Exfiltration
Additional IOCs
- File Hashes:
0080cd81db3244b8ba157ffabc1d30fe(MD5) - MD5 hash of malware sample associated with APT attacks targeting South Korea in July 202600f7955410783941d527afc12908556a(MD5) - MD5 hash of malware sample associated with APT attacks targeting South Korea in July 2026029628bd99899c750d5537ee637fe3ca(MD5) - MD5 hash of malware sample associated with APT attacks targeting South Korea in July 202603a830875abc607aa30a621eb84697c8(MD5) - MD5 hash of malware sample associated with APT attacks targeting South Korea in July 202609bd2f48fcd29a0ed46b099c4d939024(MD5) - MD5 hash of malware sample associated with APT attacks targeting South Korea in July 2026
- File Paths:
C:\ProgramData\sys.Dll- Downloader DLL dropped by Type B attacks; loads Infostealers, keyloggers, and backdoors into memory
- Command Lines:
- Purpose: Download and execute HTA payload from remote server | Tools:
curl.exe| Stage: Execution |curl.exe -o %TEMP%\ - Purpose: Register malicious scheduled task disguised as OneDrive or browser update for persistence | Tools:
schtasks.exe| Stage: Persistence |schtasks /create /tn <taskname> /tr - Purpose: Load malicious DLL into memory using regsvr32 | Tools:
regsvr32.exe| Stage: Execution |regsvr32.exe <dllpath> - Purpose: Execute Base64-encoded PowerShell payload from LNK file | Tools:
powershell.exe| Stage: Execution |powershell.exe -enc
- Purpose: Download and execute HTA payload from remote server | Tools:
Showing defanged values
- file_pathC:\ProgramData\sys.DllDownloader DLL dropped by Type B attacks; loads Infostealers, keyloggers, and backdoors into memory
- md50080cd81db3244b8ba157ffabc1d30feMD5 hash of malware sample associated with APT attacks targeting South Korea in July 2026
- md500f7955410783941d527afc12908556aMD5 hash of malware sample associated with APT attacks targeting South Korea in July 2026
- md5029628bd99899c750d5537ee637fe3caMD5 hash of malware sample associated with APT attacks targeting South Korea in July 2026
- md503a830875abc607aa30a621eb84697c8MD5 hash of malware sample associated with APT attacks targeting South Korea in July 2026
- md509bd2f48fcd29a0ed46b099c4d939024MD5 hash of malware sample associated with APT attacks targeting South Korea in July 2026
- urlhxxp://jad[.]co[.]kr/banner/item/view[.]php?bbs=17Compromised or attacker-controlled URL used for malware delivery or C2 communication in APT attacks targeting South Korea
- urlhxxp://jad[.]co[.]kr/banner/item/view[.]php?filter=4XNzW6m9NwOgVKs3xTVwO&page=lnwxWCMKoiz8lekqijFkoAMyUHiD1nGzlatURL on compromised Korean domain used for payload delivery with encoded parameters
- urlhxxp://jad[.]co[.]kr/banner/item/view[.]php?filter=vjdCJDg5FF8ViJEmU&page=G21IiLZ0QfWkYTDgOWgPBzdtdMakWhz1Second URL variant on compromised Korean domain used for payload delivery with encoded parameters
- urlhxxps://fluxoras[.]site/svg/dev[.]php?sss=christmas76Attacker-controlled domain used for malware delivery or C2 communication
- urlhxxp://www[.]dilmahshop[.]co[.]kr/shop/banner/info[.]incCompromised Korean e-commerce domain used to host malicious payload or C2 endpoint