10 minmedium
June 2026 Threat Trend Report on APT Attacks (South Korea)
AhnLab's June 2026 threat trend report documents six categorized APT attack patterns targeting South Korean entities, all initiated via spear phishing with disguised file attachments (primarily LNK files). Attack chains leverage native Windows utilities (PowerShell, mshta, curl.exe), Task Scheduler-based persistence disguised as legitimate updates, and abuse of GitHub/Google Drive for payload staging, ultimately deploying AutoIt malware, XenoRAT, infostealers, keyloggers, and custom Python/DLL side-loaded backdoors.
Conf:medium
Showing defanged values
- domainbohyeonsanvil[.]comDomain hosting a malicious file/board viewer script used in the attack chain
- domainkumhosports[.]comDomain hosting a query/log script used for payload delivery or communication
- md503e4bef86f3e3e6ea23eb6f017af0c98Hash associated with malicious file used in one of the identified APT attack types
- md505c07339603994b36dcfefcce720d03dHash associated with malicious file used in one of the identified APT attack types
- md507bb21d28ae4ab07d62f8deb4343aaebHash associated with malicious file used in one of the identified APT attack types
- md507ed2c9ed61b60078af0164f061696beHash associated with malicious file used in one of the identified APT attack types
- md50b1de625a89da12bd1fdd292b341bad3Hash associated with malicious file used in one of the identified APT attack types
- urlhxxp://bohyeonsanvil[.]com/board/board_file/viewer[.]phpBase malicious URL path used to serve attacker content
- urlhxxp://bohyeonsanvil[.]com/board/board_file/viewer[.]php?mode=5jbpdhNK85H5IZHnD91CG&data=o4mSj3SGUxz8pejDQ4k7FzKYA34jcpiWGtIMalicious URL used to serve or retrieve payload/data as part of an APT attack chain identified in June 2026
- urlhxxp://kumhosports[.]com/inc/logquery[.]phpBase malicious URL path used for query-based communication with attacker infrastructure
- urlhxxp://kumhosports[.]com/inc/logquery[.]php?query=0KuKue2Ml2EDsY4vH&number=8S0ozy6bPeRjjBHC5Kjr7JpIMu81sZIeMalicious URL used for payload delivery or C2-style query communication in observed APT attack
- urlhxxp://kumhosports[.]com/inc/logquery[.]php?query=JeNVJ4a0hubZI2ZKuH7jd&number=l1A0DxsG9hpYYauqBM5aSVXKhf3E1PNRFKOMalicious URL used for payload delivery or C2-style query communication in observed APT attack
Detection / HunterAnthropic
What Happened
AhnLab, a South Korean cybersecurity firm, published a monthly summary of targeted cyberattacks (called APT, or Advanced Persistent Threat, attacks—meaning attacks that are carefully planned against specific victims and try to stay hidden for a long time) observed in June 2026. The attacks mainly affect organizations and individuals in South Korea and start with phishing emails containing fake work documents or shortcut files that, when opened, secretly install malware capable of stealing information, logging keystrokes, and giving attackers remote control of infected computers. This matters because these attacks disguise themselves as normal business files and use legitimate tools and cloud services (like GitHub and Google Drive) to avoid detection, making them harder to spot. People should be cautious about opening unexpected email attachments or shortcut files, verify the sender before opening anything, keep their operating system, browser, and antivirus software up to date, and review their system settings for weaknesses.
Key Takeaways
- AhnLab identified multiple distinct APT attack patterns (Types A-F) targeting South Korean organizations in June 2026, predominantly delivered via spear phishing emails disguised as work-related documents.
- LNK (shortcut) files were the most common initial delivery mechanism, often containing malicious PowerShell commands alongside legitimate decoy documents to avoid suspicion.
- Threat actors abused legitimate infrastructure including GitHub repositories, Google Drive, and native Windows tools (curl.exe, mshta, pythonw.exe) to stage and execute payloads, complicating detection.
- Persistence was commonly achieved through Windows Task Scheduler registration, frequently disguised as browser updates or legitimate software components.
- Final payloads included AutoIt-based malware, XenoRAT, infostealers, keyloggers, and custom backdoors capable of remote command execution, file control, and system information exfiltration.
- One attack chain (Type E) used DLL side-loading to inject a backdoor into a legitimate process, indicating moderate evasion sophistication.
Affected Systems
- Microsoft Windows endpoints
- Organizations and individuals in South Korea targeted via spear phishing
- Users of Windows Task Scheduler, PowerShell, mshta, and curl.exe
Vulnerabilities (CVEs)
None identified.
Attack Chain
- Initial Access: Spear phishing email delivers disguised file (LNK, executable, or decoy document appearing work-related)
- Execution: User opens the file, triggering embedded PowerShell/CMD commands or Base64-encoded scripts
- Staging/Download: Malicious HTA, Python packages, or scripts are downloaded from GitHub, Google Drive, or attacker-controlled domains using curl.exe or mshta
- Persistence: Task Scheduler entries are created, disguised as browser updates or legitimate components (VBS/BAT/PowerShell/XML/JS)
- Payload Deployment: AutoIt malware, XenoRAT, infostealers, keyloggers, or Python-based backdoors are loaded into memory or side-loaded via DLL injection into legitimate processes
- Command and Control/Impact: Backdoor executes remote commands, exfiltrates system information, uploads/downloads files, and maintains remote control over the compromised host
Detection Availability
- YARA Rules: No
- Sigma Rules: No
- Snort/Suricata Rules: No
- KQL Queries: No
- Splunk SPL Queries: No
- EQL Queries: No
- Other Detection Logic: No
The article does not provide YARA, Sigma, Snort/Suricata, KQL, SPL, or EQL detection rules. It only provides IOC lists (MD5 hashes and URLs) and general behavioral descriptions of the attack types.
Detection Engineering Assessment
copy:
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Medium | Behaviors like LNK execution spawning PowerShell, Task Scheduler creation, and DLL side-loading are typically visible to EDR process/command-line telemetry, but abuse of legitimate tools (curl.exe, mshta.exe, pythonw.exe) and legitimate cloud services can blend with normal activity if not baselined. |
| Network Visibility | Medium | C2/staging traffic occurs over plain HTTP to attacker-registered domains and abused legitimate platforms (GitHub, Google Drive), which may not stand out without domain reputation or anomaly detection, though the plaintext HTTP URLs listed would be detectable via proxy/DNS logging if IOCs are loaded. |
| Detection Difficulty | Moderate | Individual techniques (LNK execution, PowerShell downloads, Task Scheduler persistence) are well-known and detectable with standard telemetry, but the use of legitimate binaries and cloud storage services for staging increases the need for behavioral correlation rather than simple signature matching. |
Required Log Sources
- Windows Event Logs (Process Creation - Event ID 4688 / Sysmon Event ID 1)
- PowerShell Script Block Logging (Event ID 4104)
- Task Scheduler operational logs (Event ID 106/200/201)
- Sysmon Event ID 7 (Image/DLL load) for side-loading detection
- Proxy/DNS logs for outbound connections to attacker domains
- File creation logs in %TEMP% directories
Hunting Hypotheses
copy:
| Hypothesis | Telemetry | ATT&CK Stage | FP Risk |
|---|---|---|---|
| Look for LNK files spawning PowerShell or cmd.exe processes with network connection activity shortly after execution, particularly from email attachment or download directories. | Process creation logs, parent-child process relationships, command-line arguments | Initial Access / Execution | Medium - some legitimate shortcuts may launch scripts, but combined with network activity from unusual command-lines this is a strong signal |
| Identify Task Scheduler entries created with names mimicking browser updates or legitimate software, executing scripts from user-writable directories. | Task Scheduler event logs, scheduled task action paths | Persistence | Low - legitimate browser update tasks are typically signed and located in standard directories, not %TEMP% or %APPDATA% |
| Detect curl.exe or mshta.exe invocations downloading and executing files from GitHub raw content URLs or Google Drive direct links outside of typical developer/IT workflows. | Process command-line logging, network proxy logs showing GitHub/Google Drive URLs | Command and Control / Delivery | Medium - developers may legitimately use curl with GitHub, requiring context around destination file types and subsequent execution |
| Hunt for unexpected DLL side-loading where a legitimate signed executable loads a DLL from a non-standard directory, potentially indicating backdoor injection. | Sysmon Event ID 7 (Image loaded), image load path anomalies | Defense Evasion | Low to Medium - legitimate software occasionally loads DLLs from application directories, requiring baseline comparison |
| Monitor for pythonw.exe or python packages being registered in Task Scheduler and executing periodically, which is unusual outside developer/automation environments. | Task Scheduler logs, process creation logs for pythonw.exe | Persistence / Execution | Medium - legitimate automation scripts may use this pattern, context (file origin, disguised names) matters |
Control Gaps
- Standard email attachment filtering may not flag LNK files that appear as legitimate document shortcuts
- Default allow-listing of common Windows binaries (curl.exe, mshta.exe) without behavioral monitoring will miss abuse of these tools
- Trust in legitimate cloud platforms (GitHub, Google Drive) as content delivery may bypass domain/URL reputation-based blocking
- DLL side-loading into legitimate signed processes can evade application whitelisting that only checks the parent binary signature
Key Behavioral Indicators
- LNK file execution immediately followed by PowerShell or cmd.exe process spawning
- Scheduled tasks with names mimicking browser update services but pointing to scripts in temp or user profile directories
- curl.exe or mshta.exe processes with command-line arguments referencing external URLs and outputting to %TEMP%
- Unsigned or unexpected DLLs loaded by signed legitimate applications
- pythonw.exe execution from non-standard installation paths registered as a scheduled task
- Outbound HTTP requests with unusual query string parameters to newly registered or low-reputation domains
False Positive Assessment
Medium - Behaviors described (PowerShell downloads, Task Scheduler persistence, use of curl.exe/mshta.exe, GitHub/Google Drive hosting) overlap with legitimate administrative and developer activity, requiring contextual and behavioral correlation rather than simple indicator matching to avoid false positives.
Recommendations
Immediate Mitigation
defender takeaway
- Verify against your organization's incident response runbook and team escalation paths before acting; consider blocking the listed URLs/domains at the proxy or firewall level if applicable to your environment.
- Consider searching endpoint and email gateway logs for the provided MD5 hashes and URLs to identify any historical or ongoing compromise.
- If your EDR supports it, consider isolating hosts that show signs of LNK-triggered PowerShell execution followed by external network connections.
Infrastructure Hardening
- Evaluate restricting or monitoring execution of LNK files received via email, particularly from external senders.
- Consider application control policies (e.g., AppLocker/WDAC) to restrict script execution (PowerShell, HTA, Python) from user-writable directories.
- Where supported by your tooling, enable enhanced PowerShell logging (script block logging, module logging) across endpoints.
- Consider auditing and restricting Task Scheduler creation permissions for standard user accounts where feasible.
User Protection
- Ensure endpoint antivirus/EDR signatures and definitions (e.g., V3 or equivalent) are kept up to date across the environment.
- Consider deploying attachment sandboxing or detonation for email attachments, especially LNK, HTA, and compressed archive file types.
- Evaluate whether browser and OS patch levels are current across the fleet to reduce exploitation surface.
Security Awareness
- Consider incorporating examples of spear-phishing lures disguised as resumes or work documents into user awareness training.
- Train users to verify sender identity and avoid opening unsolicited attachments, especially shortcut (LNK) files.
- Promote reporting channels for suspicious emails to enable faster triage by security teams.
MITRE ATT&CK Mapping
MITRE ATT&CK Mapping11 techniques
Tactic
Initial Access
Tactic
Execution
Tactic
Privilege Escalation
Tactic
Stealth
Tactic
Credential Access
Tactic
Collection
Tactic
Command and Control
Additional IOCs
- Domains:
bohyeonsanvil[.]com- Domain hosting a malicious file/board viewer script used in the attack chainkumhosports[.]com- Domain hosting a query/log script used for payload delivery or communication
- Urls:
hxxp://bohyeonsanvil[.]com/board/board_file/viewer.php- Base malicious URL path used to serve attacker contenthxxp://kumhosports[.]com/inc/logquery.php- Base malicious URL path used for query-based communication with attacker infrastructure
- File Hashes:
03e4bef86f3e3e6ea23eb6f017af0c98(MD5) - Malicious file hash from June 2026 APT campaign05c07339603994b36dcfefcce720d03d(MD5) - Malicious file hash from June 2026 APT campaign07bb21d28ae4ab07d62f8deb4343aaeb(MD5) - Malicious file hash from June 2026 APT campaign07ed2c9ed61b60078af0164f061696be(MD5) - Malicious file hash from June 2026 APT campaign0b1de625a89da12bd1fdd292b341bad3(MD5) - Malicious file hash from June 2026 APT campaign
- Command Lines:
- Purpose: Download and execute malicious HTA file using default Windows tool | Tools:
curl.exe,mshta.exe| Stage: Execution / Delivery |curl.exe -o %TEMP%\<file>.hta <url> - Purpose: Register scheduled task to maintain persistence disguised as a browser update or legitimate software | Tools:
schtasks.exe,Task Scheduler| Stage: Persistence |schtasks /create /tn <taskname> /tr - Purpose: Execute Base64-encoded payload staged in temp directory | Tools:
PowerShell,cmd.exe| Stage: Execution
- Purpose: Download and execute malicious HTA file using default Windows tool | Tools: