Analysis of the Connection Between Xctdoor and Past CRAT Attack Cases (Larva-26005)

ASEC attributes a targeted campaign by the Larva-26005 threat actor (linked to North Korea) using spear-phishing, malicious LNK files, DLL side‑loading and compromised uploads to deliver XcLoader and Xctdoor (C++ and Go variants) against Korean users; the report provides technical analysis of obfuscation/injection methods, supported C2 commands, historical linkage to CRAT and Hansom ransomware, and IoCs (MD5s, URLs, FQDNs) for detection and response.