October 2025 APT Attack Trends Report (South Korea)

**Executive summary:** AhnLab identified multiple APT spear‑phishing campaigns in South Korea in October 2025 that primarily used malicious LNK attachments and AutoIt loaders to retrieve and execute RATs (notably XenoRAT and RoKRAT); the report provides attack TTPs (PowerShell-based execution, use of Dropbox/Google Drive and renamed curl.exe, scheduled-task persistence), sample decoy filenames, MD5 hashes and download URLs, indicating active targeted data-collection operations (keylogging, screenshots, file upload/download).