A threat actor that has been phishing companies since at least 2023 is running the same playbook in 2026, and it still works. AhnLab's ASEC team, which tracks the group as Larva-24009, has published a fresh analysis of attacks targeting organizations in South Korea and abroad, and reports that the malware is essentially unchanged from the cases it documented in 2024, down to similar file names.
The group is better known to some defenders by another label. After ASEC's earlier disclosures, Cyble identified the same campaign and named it HeptaX.
How the attack works
The entry point is a phishing email carrying an LNK file, a Windows shortcut, disguised as a document. Filenames from the current wave read like ordinary business paperwork, for example NovaCX_Agency_Updated_2026047_091100_version_1_8.Docx.Lnk and NovaCX_Interview_QA+Updated_20260420_162448_version_4_4.Docx.Lnk. Across cases since 2024 the lures have covered hospital surveys, blockchain, project proposals and resumes, which ASEC reads as evidence the targets are businesses rather than consumers.
Opening the shortcut runs an obfuscated PowerShell command. It drops a decoy document into the temporary folder and opens it so nothing looks wrong, while quietly fetching a further PowerShell script from the attackers' server. That script pulls down the rest: a backdoor, a persistence component, a screenshot grabber and a script that disables Windows Defender.
Persistence is handled through the Windows Task Scheduler, using task names chosen to disappear into a normal system. ASEC lists entries impersonating an Intel Ethernet connection and two Google update tasks. A reporting component ASEC calls Notifier has been updated too. Where earlier versions all phoned home to the same server, version 2.1 uses the Telegram API to tell the operators when a new machine is infected.
Then they take the keyboard
Once established, the attackers install Quasar RAT and UltraVNC Server for hands-on control. UltraVNC opens ports such as 5800 and 5900 depending on configuration, letting the operator watch and drive the desktop through a standard viewer. ASEC believes they also work over RDP, and notes a batch script on the download server that adds a backdoor account named _BootUEFI_.
For theft, the group leans on legitimate NirSoft utilities rather than custom tooling: ChromePassView for credentials saved in Chrome, Network Password Recovery for stored network passwords, WebBrowserBookmarksView for bookmarks, and LastActivityView to reconstruct what the user has been doing. Alongside those they deploy their own keylogger, writing captured keystrokes to log files hidden under the OneDrive folder in the all-users profile directory.
What you should do
Block or quarantine .lnk attachments at the mail gateway, since almost no legitimate business correspondence needs one. Enable the Windows setting that shows file extensions, which is what makes a name ending .Docx.Lnk visibly wrong. Hunt for scheduled tasks impersonating Intel or Google updater entries, for listeners on 5800 and 5900 where UltraVNC is not deployed, and for the _BootUEFI_ account. Any tampering with Defender should be treated as an intrusion in progress, not a configuration drift. The full write-up, with the complete indicator set, is in ASEC's original report.
The same feed has tracked comparable activity against Korean firms before, including fake invoices and proposals delivering stealer malware. Our South Korea profile tracks the broader picture.
Indicators of compromise
- Payload and tool downloads: hxxp://aonexa[.]shop/candy/res/get-command[.]php, hxxp://final[.]mainsec2[.]site/secsec/tool/ChromePass[.]exe, hxxp://final[.]mainsec2[.]site/secsec/tool/netpass[.]exe
- Domains: aonexa[.]shop, final[.]mainsec2[.]site, mainsec[.]site, pozeny[.]shop, serverdock[.]online
- IP: 217[.]77[.]6[.]50
- MD5: 10b40185106eb3760cb71c46117aa0bf, 1500fefcdda275b70e2051a3e7d9f794, 2973fda8d0d0fa0200a05889fce85df6, 444fb3592cd1848660259a913684795b, 4ad28d0313549e98383144d82982be6e
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.