November 2025 APT Attack Trends Report (South Korea)

AhnLab monitored and classified APT attacks in South Korea during November 2025, finding that spear-phishing with malicious LNK attachments was the predominant delivery method; attackers used PowerShell to fetch payloads (including XenoRAT and RoKRAT) and AutoIt-based malware, established persistence via scheduled tasks, and employed decoy documents. The report catalogs confirmed filenames, MD5 hashes, and malicious URLs and characterizes the attack types and their behaviors.