The most common way an advanced attacker got onto a computer in South Korea last month was not an exploit or a stolen password. It was a shortcut. AhnLab's July 2026 review of APT activity against Korean organisations found that Windows LNK files, the pointer files behind desktop and Start menu icons, made up the largest share of intrusions it saw.
LNK files appeal to attackers because they are not really shortcuts. A .lnk carries a command line, so a file that looks like a document icon in an attachment can quietly launch PowerShell instead.
Seven recipes, one file type
AhnLab, which monitors Korean entities through its own infrastructure, sorted July's spear phishing into six variants plus an unclassified bucket. They differ mostly in what the shortcut unpacks:
- Type A hides PowerShell in the LNK that rebuilds a decoy document, a legitimate AutoIt interpreter and a malicious AutoIt script from embedded hex data, runs them from C:\ProgramData, and persists as a scheduled task disguised as a OneDrive update. It takes commands over a PubNub channel and returns results Base64 encoded.
- Type B uses curl.exe, which ships with Windows, to pull an HTA file into %TEMP% from an attacker controlled GitHub repository or Google Drive account. It drops a downloader named sys.dll that loads infostealers, keyloggers and backdoors straight into memory to collect system information, file listings and virtual asset data.
- Type C decodes Base64 into %temp% via PowerShell in the LNK, fetches decoys and scripts from GitHub, adds a scheduled task, and deploys XenoRAT type malware.
- Type D conceals documents, XML, JavaScript and PowerShell inside the shortcut, persists as a scheduled task disguised as a browser update, and ships the username, operating system, public IP and process list to Dropbox before pulling a BAT file back down.
- Type E arrives disguised as a resume, writes and schedules VBS, BAT and PowerShell files, then uses DLL side loading, tricking a legitimate program into loading the attacker's library, to inject a backdoor into a trusted process.
- Type F copies curl.exe into %TEMP%, downloads a decoy PDF and a BAT downloader, installs a Python package, and registers pythonw.exe under a disguised name in Task Scheduler so a Python backdoor can take commands from the operator's server.
- Type G, counted separately from the spear phishing set, drops a DLL and a decoy into %ProgramData% and loads the DLL with regsvr32.exe.
Nothing here is exotic, and that is the point
Read as a group, the seven prefer tools a defender cannot simply remove. curl.exe, regsvr32.exe, PowerShell, Task Scheduler and Python are built into Windows or are ordinary developer software, and the staging sits on GitHub, Google Drive, Dropbox and PubNub rather than on servers that stand out in network logs. Persistence is dressed up as a OneDrive or browser update, and the decoy document that opens on screen is genuine.
AhnLab does not attribute the variants to a named group in the report itself, and files the piece under its Kimsuky tag. Kimsuky is the North Korea linked group most associated with this style of spear phishing against South Korean targets, though that tag is the vendor's classification, not a per campaign attribution. It is not the only North Korea linked activity Korean organisations faced this summer: a separate campaign delivered backdoors through Korean software supply chains earlier in August.
Indicators and what actually helps
Indicators in AhnLab's report include the URLs hxxps://fluxoras[.]site/svg/dev[.]php?sss=christmas76 and hxxp://www[.]dilmahshop[.]co[.]kr/shop/banner/info[.]inc, plus sample hashes including MD5 0080cd81db3244b8ba157ffabc1d30fe.
AhnLab's own advice is the unglamorous kind: verify who sent a file, do not open attachments from unknown sources, check for weak system settings, and keep the operating system, browsers and its V3 product patched. Add the control that fits this pattern. A shortcut has no business arriving by email, and blocking .lnk attachments at the gateway shuts the door on six of the seven variants above.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.