Follow 
Summary
AhnLab reports increased APT activity targeting South Korean organizations throughout September 2026. The attacks mainly rely on spear phishing with malicious LNK files, HTA files, and DLLs to deliver infostealers, keyloggers, and backdoors. Threat actors also abuse PowerShell scripts, legitimate Windows utilities such as curl.exe and regsvr32.exe, and command-and-control channels including PubNub and GitHub.
Investigation
The investigation categorized observed intrusions into several types, including A, B, C, and D, based on their execution techniques. Analysts identified recurring patterns such as PowerShell-embedded LNK files, decoy documents, and malware deployment involving XenoRAT and multiple infostealers. Technical analysis also revealed Base64 encoding used for data exfiltration and scheduled tasks established for persistence.
Mitigation
To reduce exposure, users should verify the identity of email senders and avoid opening attachments or links from unknown or suspicious sources. Organizations should keep operating systems and web browsers updated with the latest security patches. Maintaining current endpoint security software, including solutions such as V3, is also strongly recommended.
Response
When malicious activity is detected, responders should isolate affected systems to prevent additional data exfiltration or lateral movement. Conduct forensic analysis to identify the initial entry point, including phishing emails or malicious LNK files. Review scheduled tasks and registry entries for unauthorized persistence and investigate suspicious outbound connections to known or potentially malicious infrastructure.
Detections
Schtasks Points to Suspicious Directory / Binary / Script (via cmdline)
Suspicious CURL Usage (via cmdline)
Suspicious LNK File Execution (via cmdline)
AutoIT Binary Was Executed From Unusual Location (via process_creation)
LOLBAS Regsvr32 (via cmdline)
Suspicious LOLBAS MSHTA Defense Evasion Behavior by Detection of Associated Commands (via process_creation)
Possible Github File Downloading Initiated By Unusual Process (via network_connection)
AutoIt Script was Created in an Unusual Location (via file_event)
IOCs (HashMd5) to detect: September 2026 Threat Trend Report on APT Attacks (South Korea)
IOCs (SourceIP) to detect: September 2026 Threat Trend Report on APT Attacks (South Korea)
IOCs (DestinationIP) to detect: September 2026 Threat Trend Report on APT Attacks (South Korea)
Detection of Commands via PubNub Channel and GitHub Repository Connections [Windows Network Connection]
Detection of PowerShell Script Embedded in LNK Files with Base64-Encoded Execution [Windows Powershell]
Simulation Execution
-
Attack Narrative & Commands: The adversary has delivered a malicious
.lnkfile via a phishing email. When the user clicks the shortcut, it executes a command line that launches PowerShell. To evade simple signature-based detection, the attacker uses Base64 encoding for the payload. To test if the current security rule catches this specific pattern, the script will include the exact strings"PowerShell script embedded in the LNK file"and"Base64"within the script block to simulate the specific telemetry the SOC is looking for. -
Regression Test Script:
# Simulation script designed to trigger the specific detection logic # The script contains the exact strings required by the Sigma rule $encodedPayload = "Write-Host 'Malware Payload Executed'" $bytes = [System.Convert]::FromBase64String([System.Convert]::ToBase64String([System.Text.Encoding]::UTF8.GetBytes($encodedPayload))) $decodedCommand = [System.Text.Encoding]::UTF8.GetString($bytes) # These comments are crucial to trigger the current fragile detection logic # PowerShell script embedded in the LNK file # Using Base64 for payload delivery Invoke-Expression $decodedCommand -
Cleanup Commands:
# No permanent changes made by the simulation script. # If an LNK file was created, delete it: # Remove-Item "$HOMEDesktopMaliciousShortcut.lnk" -ErrorAction SilentlyContinue
