December 2024 Threat Trend Report on APT Attacks (South Korea)

AhnLab reports that December 2024 APT activity targeting Korean entities primarily used spear-phishing with malicious LNK files to deploy multi-stage payloads: Type A extracted CAB archives containing scripts for data exfiltration and payload download, while Type B deployed RATs (e.g., XenoRAT, RoKRAT) via PowerShell and cloud-hosted binaries; the report includes sample decoy files, confirmed filenames, MD5 hashes and malicious URLs as IOCs.