South Korean organizations are being hit with a backdoor that logs keystrokes, grabs screenshots and hands attackers remote control of the machine, and researchers now say the crew behind it has been working against Korea since at least 2020.
AhnLab SEcurity intelligence Center (ASEC) published an analysis linking the Xctdoor backdoor, which it first documented in 2024, to CRAT, older malware that the firms who investigated it attributed to North Korea's Lazarus group. ASEC tracks the current operators under its own label, Larva-26005, and says they ran CRAT and an early build of Xctdoor together, at times alongside the Hansom ransomware, before settling on Xctdoor alone. CRAT itself surfaced in April 2020 in spear phishing that used a Hangul document exploiting CVE-2017-8291, and a Cisco Talos report that year documented the pairing with Hansom.
ASEC's case for the link is structural rather than circumstantial: both families install to the same Windows AppX package path, both decrypt their obfuscated code at runtime, and both verify identical start and end patterns around that obfuscated block before running it.
What's affected
The victims are Windows users in South Korea, and two delivery routes are in play. In March 2026, the Korean security firm Hauri reported an installer impersonating Veraport, a certificate handling tool widely deployed on Korean sites; ASEC found a matching build impersonating SoftCamp served from the same address. The second route is spear phishing with LNK shortcut files, which ASEC says accounts for most of what its own telemetry picked up. Shortcuts seen in April, June and July 2026 carried names such as "Account Statement", "Refund Application", "Product Registration" and a sales resume, which ASEC reads as a shift toward corporate staff rather than general users alone.
How the attack works
The fake installers rely on DLL side loading, where a legitimate signed program is tricked into loading a malicious library sitting beside it. The Veraport lure ships Sysinternals' ShellRunAs renamed to mimic the real installer, which then loads a malicious credui.dll; the SoftCamp lure uses a Microsoft binary to load RADCUI.dll. Both then run the genuine installer, so the victim sees what they expected to see.
From there the dropper writes VBS and BAT scripts into a public videos folder, registers one of them in Task Scheduler, and pulls down an encrypted copy of Xctdoor along with its loader, XcLoader. A PowerShell stage XOR decodes the payloads and parks them inside a Microsoft Office 365 Hub package directory as roaming.dat and settings.lock, then launches the loader with regsvr32 and drops a startup shortcut for persistence.
The 2024 cases ASEC re-examined were noisier. In one, the operators took an unmanaged Windows IIS server, planted a web shell, installed the backdoor and added the Ngrok tunneling tool to reach systems behind NAT. In another they abused a file upload page on an internet-facing groupware system, then trojanized the installer for BeeBEEP, an open source messenger, and swapped it into the groupware to spread internally. A Korean ERP product was hit the same way, with a malicious DLL wired into its update module.
What the backdoor can do
Xctdoor exists in C++ and Go builds that ASEC describes as functionally near identical. Its command set covers keylogging on every keystroke, clipboard capture, screenshots on a timer, file upload and download, process listing and termination, shell command execution, injection into other processes, and alerts when a new drive is attached or the user steps away from the machine.
Indicators
ASEC lists these defanged download URLs: hxxp://hesenorm[.]info/download/xtps for the encrypted backdoor, hxxp://hesenorm[.]info/download/lcpy for XcLoader, and hxxp://hesenorm[.]info/download/pxt2 for the PowerShell stage.
What you should do
There is no patch here, because this is a delivery problem rather than a product flaw. Treat security software obtained anywhere other than the vendor as suspect, block or alert on LNK files arriving by mail, and hunt for regsvr32 launching DLLs out of user profile package directories or for scripts written into public media folders. Organizations that host their own groupware or ERP update channels should confirm those installers still match the vendor's. The shape is familiar: last week we covered compromised Korean websites pushing spy backdoors and Gunra ransomware through trusted local software.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.