July 2026 Threat Trend Report on APT Attacks (South Korea)

AhnLab observed multiple targeted APT campaigns in South Korea (July 2026) using spear-phishing—notably LNK-based loaders—to deliver backdoors, infostealers, and loaders. Attack patterns include embedded PowerShell/HEX extraction, use of native tools (curl, regsvr32), Task Scheduler persistence, DLL side‑loading, and exfiltration via PubNub/Dropbox; the report lists sample MD5s and malicious URLs and notes some variants may evade current detection.