Trusted Design

July 2026 Threat Trend Report on APT Attacks (South Korea)

概要

During July 2026, multiple APT campaigns targeted entities in South Korea primarily through spear phishing attacks utilizing LNK files. Seven distinct attack types (A through G) were identified, each employing different techniques including PowerShell scripts, AutoIt programs, curl.exe downloads, and DLL side-loading. Attackers distributed malware through platforms like GitHub, Google Drive, and Dropbox, often disguised as legitimate documents or resumes. These campaigns deployed backdoors, infostealers, keyloggers, and XenoRAT malware to exfiltrate system information, credentials, virtual asset data, and maintain persistent access through Task Scheduler entries. Communications occurred via PubNub channels with data encoded in Base64. The attacks primarily began with phishing emails containing work-related content designed to deceive specific victims into executing malicious files.

Created: 2026-08-28

Indicators

• FileHash-MD5 - 09bd2f48fcd29a0ed46b099c4d939024 -
• FileHash-MD5 - 0080cd81db3244b8ba157ffabc1d30fe -
• FileHash-MD5 - 029628bd99899c750d5537ee637fe3ca -
• FileHash-MD5 - 00f7955410783941d527afc12908556a -
• FileHash-MD5 - 03a830875abc607aa30a621eb84697c8 -

類似Pulses

類似するPulseは見つかりませんでした。

このPulseに関連する脅威アクター (事実ベース)

このPulseに関連する脅威アクター (推論ベース)

Related CVEs

このPulseに見つかったCVEはありません。

Pulse – 脅威アクター グラフ

---

← Pulse一覧に戻る