May 2026 Threat Trend Report on APT Attacks (South Korea)

AhnLab monitored a series of domestic APT campaigns in South Korea (May 2026) that primarily used spear‑phishing (notably malicious LNK, CHM, and JSE artifacts) to deliver loaders, Python and AutoIt backdoors, XenoRAT-type malware, and infostealers; attackers used PowerShell, certutil, Task Scheduler persistence, DLL side‑loading, and legitimate tools (curl, regsvr32) to download, execute, and maintain access. The report categorizes activity into multiple types (A–H), lists MD5 hashes, C2 URLs and FQDNs, and recommends verifying senders, avoiding unknown attachments, patching systems and browsers, and keeping V3 updated.