February 2025 APT Group Trends (South Korea)

AhnLab observed multiple APT-style spear-phishing campaigns in South Korea during February 2025 that delivered malicious LNK files. The LNKs unpack CAB archives and execute obfuscated PowerShell, batch, VBS, or Python components (including a pythonw.exe+malicious script registered as a scheduled task) to exfiltrate information and fetch additional malware; the report lists sample filenames, MD5 hashes, and command-and-control/download URLs.