- AhnLab says most APT attacks it detected in Korea in September 2026 were spear phishing, and shortcut (LNK) files made up the largest share.
- The four chains it describes used built-in Windows tools and services such as GitHub, Google Drive and PubNub, so early steps can look normal to detection that only seeks known-bad files.
- Leaders should ask whether their tools flag shortcut files in email and unexpected scheduled tasks, and how fast staff can report a suspicious message.
The attack hides inside ordinary tools and ordinary mail
AhnLab's September report on attacks in Korea describes a pattern worth a manager's attention. A work-style email arrives with a file. The file opens a document that seems fine. Meanwhile, tools that Windows already ships do the harmful work.
The September cases show attackers leaning on tools the victim already trusts. These include built-in utilities, popular online services and a scheduled task named like a routine update. The report does not say whether exploits of software flaws were also used.
What AhnLab reported
AhnLab's security research centre, ASEC, tracks advanced persistent threat (APT) attacks on Korean organisations using its own monitoring. An APT is a patient, targeted intrusion aimed at a specific organisation or group of people. This report covers September 2026.
AhnLab says most of the attacks it identified were spear phishing. That means emails aimed at specific people or groups, with harmful attachments or links. Attacks using LNK files made up the largest share. AhnLab also says many emails were disguised as work-related correspondence.
An LNK file is a Windows shortcut. It looks harmless, but it can be set to run commands when opened. That makes it a useful disguise.
How the attacks worked
AhnLab describes several chains. The four below are examples from the report. They are not a measured breakdown of all attacks. The report does not say how typical each one is.
In the first, a PowerShell script inside an LNK file pulled hidden data out of the file itself. PowerShell is a built-in Windows scripting tool. From that data it rebuilt three items: a genuine-looking document to show the user, a legitimate AutoIt program, and a harmful AutoIt script. AutoIt is a scripting tool for Windows. The script ran from the C:\ProgramData folder. AhnLab says it also added a scheduled task disguised as a OneDrive update, so the malware would keep running.
The infected machine then took commands over a PubNub channel. AhnLab says the channel name came from the computer name and username. Replies went out encoded in Base64.
In the second case, the attacker used curl.exe, a standard Windows download tool, to fetch an HTA file into the %TEMP% folder. AhnLab says the file was hosted on a GitHub repository or Google Drive run by the attacker. It created a decoy and a downloader named sys.dll. The downloader loaded three kinds of malware into memory: an infostealer, a keylogger and a backdoor. AhnLab says the infostealer collects system details, lists of important files and data tied to virtual assets.
In the third, PowerShell code in an LNK file connected to a GitHub repository and downloaded more scripts. It also created a scheduled job. AhnLab says the result was stolen system information and the installation of XenoRAT-type malware, a remote-access tool. The fourth case used regsvr32.exe, another legitimate Windows tool, to load a backdoor DLL into memory.
Why this is hard to defend
Early steps in these chains use tools a company already trusts. Windows utilities are on every machine. GitHub, Google Drive and OneDrive are in daily use.
So detection that relies only on known-bad files may see those steps as normal. Later payloads still matter. The chains also dropped AutoIt scripts, an HTA file, a DLL and backdoor malware, and these can be caught.
The lesson here is to watch behaviour as well as file names. A shortcut that launches PowerShell deserves a look. So does a scheduled task that claims to be an update but was created by a document.
The person who opens the email is doing their job. They see a normal document, so nothing seems wrong. That is why reporting habits matter as much as filters.
AhnLab also published a separate report on infostealers. It covers cracked software and email lures. That report is not about these APT cases.
What this report cannot tell you
The report is a monthly summary from one vendor's own monitoring, covering Korea. AhnLab warns that many attacks may be unconfirmed and left out. The text provided does not name the groups behind the activity. It also gives no attack counts. Do not read it as a measure of how many organisations were hit.
Questions to put to your security team
First, does email filtering flag or strip LNK files, including those inside archives? Second, can your endpoint tools alert when a shortcut file starts PowerShell, curl.exe or regsvr32.exe? Third, does anyone review newly created scheduled tasks, especially those named after update services?
Fourth, can staff report a suspicious email in one step, and does someone answer quickly? AhnLab's own advice is to verify the sender and avoid files from unknown sources. It also advises checking for vulnerable settings and patching the operating system and browser.
Trusted tools can carry untrusted work. Defences need to know what routine tools should and should not do.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: AhnLab ASEC.
