September 2025 APT Attack Trends Report (South Korea)

AhnLab observed and analyzed APT spear-phishing activity in South Korea (September 2025) that used malicious LNK files to extract bundled CAB archives and execute scripts which leak information and deploy additional malware, including RATs (XenoRAT, RoKRAT). The report includes confirmed malicious filenames, decoy documents, MD5 hashes, URLs and IP addresses as indicators of compromise, and describes two LNK-based delivery variants: one that extracts/decompresses and runs multiple scripts and another that deploys remote access trojans via cloud download or local persistence.