June 2026 Threat Trend Report on APT Attacks (South Korea)

AhnLab monitored and classified multiple domestic APT campaigns in Korea observed in June 2026, noting spear-phishing distribution using LNK/HTA/PowerShell, varied loaders and persistence mechanisms (Task Scheduler, DLL side-loading, Python backdoors), and deployment of infostealers, keyloggers, and remote-control backdoors; the report includes MD5 hashes and malicious URLs as indicators and recommends patching, cautious handling of email attachments, and updating defenses.