Loading story…
FortiGuard Labs reported a high-severity cyber espionage campaign linked to North Korean state-sponsored actors that targets organizations in South Korea with phishing emails carrying malicious Windows .lnk files disguised as PDF documents. When opened, the shortcut launches PowerShell and other native Windows scripting tools while showing a decoy document, then performs anti-analysis checks for tools including Wireshark, Fiddler, x64dbg, Procmon, and vmtoolsd. Researchers said the operation has been active since at least 2024 and has evolved from earlier, less-obfuscated variants associated with XenoRAT into more sophisticated samples that embed decoding logic and payload data directly in the shortcut file.
The malware establishes persistence through a Scheduled Task disguised as a technical paper and set to run every 30 minutes, then collects host data such as OS version, build number, process lists, and keep-alive logs. Operators used trusted GitHub accounts and private repositories as covert command-and-control and data-staging infrastructure, allowing malicious HTTPS traffic to blend with normal web activity while exfiltrating system information and retrieving follow-on instructions. Decoy filenames and metadata, including the "Hangul Document" naming convention, indicate deliberate targeting of South Korean companies and tradecraft aligned with clusters such as Kimsuky, APT37, and Lazarus.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
On April 3, 2026, FortiGuard Labs disclosed a high-severity espionage campaign attributed to North Korean state-sponsored actors, citing tradecraft and targeting patterns consistent with groups such as Kimsuky, APT37, and Lazarus.
The campaign shifted to more advanced LNK files that embed decoding logic and payload data, launch PowerShell and VBScript, perform anti-analysis checks, establish scheduled-task persistence, and use private GitHub repositories for command-and-control and data exfiltration.
Researchers reported that earlier versions of the operation used less-obfuscated LNK samples associated with XenoRAT before the campaign evolved into more sophisticated surveillance-focused malware.
FortiGuard Labs said the espionage campaign has been active since at least 2024, using phishing lures with malicious Windows LNK files disguised as PDF documents to target organizations in South Korea.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
7 references tracked. Mallory keeps watching after this page renders.
infosecwriteups.com
Open sourcesecurityaffairs.com
Open sourcethehackernews.com
Open sourcebsky.app
Open sourcescworld.com
Open sourcehackread.com
Open sourcecybersecuritynews.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers distributed malicious Windows shortcut (`.LNK`) files disguised as privacy consent forms and other work-related documents, tricking users into launching obfuscated PowerShell that fetched additional payloads from external infrastructure. Reporting indicates GitHub was used as a covert stage in the infection chain, helping operators blend malicious downloads and command retrieval into legitimate web traffic while keeping much of the activity fileless and in memory. Once executed, the malware created downloader and loader scripts, established persistence through Windows Task Scheduler, opened decoy documents to reduce suspicion, and deleted the original shortcut to limit forensic artifacts. Observed follow-on payloads included an information stealer and a backdoor loader that decrypted and loaded malware into memory; the theft activity gathered host, security product, network, IP, drive, file, and process data, with behavior resembling prior **Kimsuky**-linked operations.
Jun 29, 2026
Multiple recent intrusion reports describe **phishing-led Windows compromises** that rely on **weaponized `.LNK` shortcuts** to trigger **obfuscated PowerShell** execution, display decoy documents, and then fetch additional payloads from public cloud/code platforms. In South Korea, attackers distributed an LNK disguised as financial trading guidance that opens a decoy PDF while running PowerShell; subsequent stages perform anti-analysis/virtualization checks, establish persistence, and retrieve a masked executable from **GitHub** that decrypts code at runtime to run **MoonPeak** malware. Researchers assessed the activity as likely **North Korea–linked** based on GitHub commit metadata and naming patterns. A separate Russia-targeted campaign used business-themed archives containing decoy documents and a malicious LNK to pull a PowerShell loader that establishes persistence and then weakens defenses (including **Microsoft Defender exclusion changes** and use of **`defendnot`**), performs reconnaissance, and tampers with system tooling and file associations before deploying **Amnesia RAT** (fetched from **Dropbox**) and a **Hakuna Matata–derived ransomware** payload for encryption. By contrast, reporting on **KazakRAT** describes a different espionage operation in Kazakhstan/Afghanistan delivered via malicious **MSI** installers and using simple, unencrypted HTTP C2; it is not part of the LNK/PowerShell delivery chains described in the other incidents.
Jun 29, 2026
Researchers reported that **APT37** targeted Korean users with spear-phishing emails posing as urgent Microsoft Account Team messages and cybersecurity advisories, delivering ZIP archives that contained malicious `.lnk` files. The shortcut files abused native Windows tools including `cmd`, `PowerShell`, and `curl.exe` to fetch a decoy document and staged payloads, ultimately installing **NarwhalRAT**, a Python-based remote access trojan compiled from Python code. Genians linked the activity to Korea-focused infrastructure and artifacts, including references to `naverwhale`, KakaoTalk-related handling, and Korean relay servers. Once installed, NarwhalRAT established persistence through a scheduled task disguised as a Microsoft task, performed anti-VM checks, and enabled broad surveillance and control functions such as keylogging, screen capture, microphone recording, file transfer, USB data collection, and remote command execution. The malware used a dual command-and-control design that combined Korean relay domains with the **pCloud API** as a dead-drop resolver, complicating detection and tracking. Researchers urged defenders to strengthen EDR coverage for suspicious LNK-to-PowerShell execution chains, unusual scheduled task creation, unexpected `curl.exe` activity, and silent Python execution.
Jun 29, 2026