APT Attack Trends in South Korea: September 2026

Summary

AhnLab reports increased APT activity targeting South Korean organizations throughout September 2026. The attacks mainly rely on spear phishing with malicious LNK files, HTA files, and DLLs to deliver infostealers, keyloggers, and backdoors. Threat actors also abuse PowerShell scripts, legitimate Windows utilities such as curl.exe and regsvr32.exe, and command-and-control channels including PubNub and GitHub.

Investigation

The investigation categorized observed intrusions into several types, including A, B, C, and D, based on their execution techniques. Analysts identified recurring patterns such as PowerShell-embedded LNK files, decoy documents, and malware deployment involving XenoRAT and multiple infostealers. Technical analysis also revealed Base64 encoding used for data exfiltration and scheduled tasks established for persistence.

Mitigation

To reduce exposure, users should verify the identity of email senders and avoid opening attachments or links from unknown or suspicious sources. Organizations should keep operating systems and web browsers updated with the latest security patches. Maintaining current endpoint security software, including solutions such as V3, is also strongly recommended.

Response

When malicious activity is detected, responders should isolate affected systems to prevent additional data exfiltration or lateral movement. Conduct forensic analysis to identify the initial entry point, including phishing emails or malicious LNK files. Review scheduled tasks and registry entries for unauthorized persistence and investigate suspicious outbound connections to known or potentially malicious infrastructure.

Simulation Execution

• Attack Narrative & Commands: The adversary has delivered a malicious .lnk file via a phishing email. When the user clicks the shortcut, it executes a command line that launches PowerShell. To evade simple signature-based detection, the attacker uses Base64 encoding for the payload. To test if the current security rule catches this specific pattern, the script will include the exact strings "PowerShell script embedded in the LNK file" and "Base64" within the script block to simulate the specific telemetry the SOC is looking for.

• Regression Test Script:

  # Simulation script designed to trigger the specific detection logic
  # The script contains the exact strings required by the Sigma rule
  
  $encodedPayload = "Write-Host 'Malware Payload Executed'"
  $bytes = [System.Convert]::FromBase64String([System.Convert]::ToBase64String([System.Text.Encoding]::UTF8.GetBytes($encodedPayload)))
  $decodedCommand = [System.Text.Encoding]::UTF8.GetString($bytes)
  
  # These comments are crucial to trigger the current fragile detection logic
  # PowerShell script embedded in the LNK file
  # Using Base64 for payload delivery
  
  Invoke-Expression $decodedCommand

• Cleanup Commands:

  # No permanent changes made by the simulation script.
  # If an LNK file was created, delete it:
  # Remove-Item "$HOMEDesktopMaliciousShortcut.lnk" -ErrorAction SilentlyContinue