Follow 
Detection stack
- AIDR
- Alert
- ETL
- Query
Summary
AhnLab documented multiple APT attack trends targeting South Korean organizations throughout August 2026. The campaigns primarily relied on spear phishing with malicious LNK files to deliver various payloads, including AutoIt scripts, Python backdoors, and XenoRAT. The attacks were designed to steal information, gain control over compromised systems, and distribute additional malware.
Investigation
AhnLab monitored APT activity against South Korean entities using its proprietary threat intelligence and security infrastructure. Researchers grouped the observed campaigns into several categories, from Type A through Type F, based on their execution techniques, including LNK file abuse, DLL side-loading, PowerShell commands, and other multi-stage infection methods.
Mitigation
Users should avoid opening attachments or files received from unknown or untrusted sources and verify the sender’s identity before interacting with suspicious content. Organizations should regularly patch operating systems and web browsers. Keeping endpoint security products, including V3, updated to the latest version is also strongly recommended.
Response
When suspicious activity is detected, organizations should investigate the origin of phishing messages and search for unauthorized scheduled tasks or abnormal processes such as pythonw.exe or sys.dll. Review system logs for unusual PowerShell or CMD activity and validate legitimate application files to identify potential DLL side-loading attempts.
Attack Flow
We are still updating this part.
Detections
LOLBAS WScript / CScript (via process_creation)
Suspicious CURL Usage (via cmdline)
Suspicious LOLBAS MSHTA Defense Evasion Behavior by Detection of Associated Commands (via process_creation)
Suspicious Scheduled Task (via audit)
IOCs (HashMd5) to detect: August 2026 Threat Trend Report on APT Attacks (South Korea)
Detection of Malicious Activity Involving Disguised Document Files with OLE Object in Hangul Document [Windows File Event]
APT Spear Phishing with LNK Files Executing Malicious PowerShell Scripts [Windows Process Creation]
Simulation Execution
-
Attack Narrative & Commands: An adversary sends a spear-phishing email containing a zipped
.lnkfile. When the user clicks the LNK, it executes a hidden PowerShell command. To achieve their objective of downloading a second-stage payload, the script uses a command line containing the string ‘Base64’ to decode a hex-encoded blob, simulating the extraction of a malicious payload to prepare for Task Scheduler persistence. -
Regression Test Script:
# Simulation script to trigger the detection rule # This mimics an LNK file launching a PowerShell process with suspicious keywords. $suspiciousCommand = "powershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -Command "$data = 'SGVsbG8gd29ybGQ='; [System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String($data)) | Out-File -FilePath $env:TEMPtest.txt; Write-Host 'Processing Base64 payload...'"" Start-Process cmd.exe -ArgumentList "/c $suspiciousCommand" -
Cleanup Commands:
# Cleanup the artifacts created during simulation Remove-Item -Path "$env:TEMPtest.txt" -ErrorAction SilentlyContinue
