Essential Insights
- Spear-phishing LNK files were the leading attack method, using PowerShell and decoy documents to launch malware.
- Attackers established persistence with disguised scheduled tasks and used PubNub or GitHub for command delivery.
- Payloads included backdoors, XenoRAT, keyloggers, and infostealers capable of stealing data and enabling system control.
Threat, Attack Techniques, and Targets
AhnLab identified spear phishing as the main attack method against entities in South Korea in September 2026. Attackers most often used LNK files and disguised malicious files as legitimate work documents. The report does not name specific sectors or organizations.
- Type A: An LNK file ran PowerShell and AutoIt scripts. Attackers used a disguised Task Scheduler entry for persistence and a PubNub channel to receive commands. The malware encoded stolen data in Base64.
- Type B: Attackers used curl.exe to download an HTA file. A downloader then loaded infostealers, keyloggers, and backdoors into memory.
- Type C: An LNK file ran PowerShell code that downloaded more scripts from GitHub, created a scheduled task, and deployed XenoRAT.
- Type D: Attackers used regsvr32.exe to load a malicious DLL backdoor.
- Type Unknown: Attackers used multiple LNK files and decoys in a spear phishing campaign.
Impact, Security Implications, and Remediation
These attacks can expose system information, key files, and virtual asset details. They can also capture keystrokes, give attackers control of systems, and install or upload additional malware. In addition, scheduled tasks and backdoors can help attackers maintain access.
Therefore, verify email senders and avoid opening files from unknown sources. Check systems for vulnerable settings, install the latest operating system and browser patches, and update AhnLab V3. The report also lists MD5 hashes and URLs as indicators that security teams can review and check against their telemetry.
Continue Your Tech Journey
Stay informed on the revolutionary breakthroughs in Quantum Computing research.
Explore past and present digital transformations on the Internet Archive.
ThreatIntel-V1
