Loading malware…
Xctdoor is a Windows backdoor associated with North Korea-linked intrusion activity targeting South Korean users and organizations. It has been attributed in reporting to the Larva-26005 cluster and has been linked through tradecraft and campaign continuity to earlier CRAT operations, with some assessments noting overlap with Lazarus- or Andariel-linked activity. Recent operations appear focused on information theft and covert access rather than confirmed ransomware deployment, although earlier related campaigns reportedly deployed Xctdoor alongside CRAT and Hansom ransomware.
Xctdoor has been observed delivered through multiple intrusion paths, including spearphishing with malicious LNK lures, malware disguised as legitimate security software, DLL sideloading chains, and supply-chain style compromises involving tampered installers and enterprise software update mechanisms. Additional cases involved server-side compromise through web shells on exposed Windows IIS infrastructure and exploitation of vulnerable groupware upload functionality, followed by deployment of XcLoader and Xctdoor.
Operationally, Xctdoor is commonly staged by XcLoader, which decrypts the payload and injects it into legitimate Windows processes for execution. Campaigns have used both C++ and Go variants. The malware and its supporting components employ runtime code obfuscation and deobfuscation to hinder analysis. Observed execution chains also used RegSvr32-based execution and persistence, startup shortcuts, scheduled tasks, and DLL sideloading through legitimate binaries.
Xctdoor provides broad backdoor functionality for post-compromise control and collection. Reported capabilities include shell access, command execution, file and folder operations, upload and download, process enumeration and termination, keylogging, screenshot capture, shared-memory operations, configuration changes, and host reconnaissance. It also monitors user-absence conditions such as session lock state, screensaver activation, and monitor-off status, likely to time operator activity and reduce detection risk.
Victimology and lure themes indicate targeting of both general users and corporate environments in South Korea, including business, legal, finance, recruitment, security, and software-related contexts. Supply-chain cases involving collaboration software and ERP update channels indicate interest in organizational access and internal propagation opportunities.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
ASEC recently confirmed that the Larva-26005 threat actor is distributing Xctdoor to users in Korea... In these attacks, Xctdoor was ultimately installed, with two variants used: one written in C++ and the other in Go.
AhnLab SEcurity intelligence Center (ASEC) recently confirmed that the Larva-26005 threat actor is distributing Xctdoor to users in Korea. Xctdoor was disclosed through the ASEC blog in 2024, and in March 2026, Hauri disclosed an attack case in which the malware was disguised as an integrated security program.
26 distinct techniques documented for this family, organized by ATT&CK tactic.
In another case, it is presumed that the threat actor attempted an Initial Breach through the upload page of a groupware system that was exposed to the outside. By exploiting a vulnerable file upload page, the threat actor uploaded a web shell...
CRAT was first identified in 2020 and was used in various attack cases targeting South Korean users, including spear phishing attacks... The first detected instance of CRAT was distributed via a spear phishing attack using a Hangul document with the file name “Coronavirus Response Emergency Inquiry.Hwp” that exploited the CVE-2017-8291 vulnerability.
“{Random}.Bat” performs its downloader function while simultaneously registering the VBS downloader malware “%PUBLIC%\videos\p{random}.Vbs,” located in the same Path, in the Task Scheduler.
This PowerShell script registers a Task Scheduler job named “office365” to ensure the VBScript file runs every 10 minutes.
The commands this backdoor receives from the C2 server are as follows... 0X10011 Command execution with the window visible (using ShellExecute) 0X10012 Command execution with the window hidden (using CreateProcess)
“p{random}.Vbs” downloads the PowerShell script “%PUBLIC%\videos\2.Ps1”. The PowerShell script “%PUBLIC%\videos\2.Ps1” moves the file that was downloaded with the random name... It also XOR-decodes the “l{random}” file...
“S{random}.Vbs” executes the BAT downloader malware “%PUBLIC%\videos\{random}.Bat,” located in the same Path... 0X10021 Multiple command execution (using cmd /c)
First, the VBS launcher malware “%PUBLIC%\videos\s{random}.Vbs” is executed. “S{random}.Vbs” executes the BAT downloader malware... while simultaneously registering the VBS downloader malware “%PUBLIC%\videos\p{random}.Vbs”
As the malware is currently being distributed via LNK files... LNK files are used during the Initial Intrusion phase. The LNK malware acts as a dropper; similar to the security program disguise case described above, it displays a decoy document file while simultaneously creating and executing three script files.
the threat actor patched a Korean ERP solution to execute malware to maintain persistence... used the Regsvr32.Exe process to execute a malicious DLL. The DLL executed by this program was Xctdoor... attackers modified the installation file of BeeBEEP... to insert a routine that creates and executes Xctdoor
“{Random}.Bat” performs its downloader function while simultaneously registering the VBS downloader malware “%PUBLIC%\videos\p{random}.Vbs,” located in the same Path, in the Task Scheduler.
This PowerShell script registers a Task Scheduler job named “office365” to ensure the VBScript file runs every 10 minutes.
In one case, the threat actors first compromised an unmanaged Windows IIS web server to install a web shell... By exploiting a vulnerable file upload page, the threat actor uploaded a web shell and gained initial control over the groupware system.
Once this process is complete, the following command uses RegSvr32 to run XcLoader, which creates and executes a shortcut on the startup path to maintain persistence... Upon execution, it injects itself into a legitimate process and creates a LNK file... and registers an LNK file that executes it via RegSvr32 in the Run key.
“{Random}.Bat” performs its downloader function while simultaneously registering the VBS downloader malware “%PUBLIC%\videos\p{random}.Vbs,” located in the same Path, in the Task Scheduler.
This PowerShell script registers a Task Scheduler job named “office365” to ensure the VBScript file runs every 10 minutes.
In the 2024 incident, the threat actor also used XcLoader to inject Xctdoor into legitimate processes... If the “settings.Ini” file exists, the process name stored as a string in that file is retrieved, and the previously decoded roaming.Dat PE file is injected into that process.
Once this process is complete, the following command uses RegSvr32 to run XcLoader, which creates and executes a shortcut on the startup path to maintain persistence... Upon execution, it injects itself into a legitimate process and creates a LNK file... and registers an LNK file that executes it via RegSvr32 in the Run key.
Threat actors name the files to resemble resume documents containing company names and job titles, and when executed, they display a legitimate decoy file alongside the malicious file to lower the user’s suspicion.
In the 2024 incident, the threat actor also used XcLoader to inject Xctdoor into legitimate processes... If the “settings.Ini” file exists, the process name stored as a string in that file is retrieved, and the previously decoded roaming.Dat PE file is injected into that process.
Some of the downloaded files are encoded in Base64 and, after decoding, are saved as additional PowerShell scripts
Execution command: C:\WINDOWS\system32\regsvr32.Exe /s %LOCALAPPDATA%\Packages\Microsoft.MicrosoftOffice365Hub_8wekyb3d8bbwe\Settings\settings.Lock... the threat actor exploited a Korean ERP solution by inserting a routine into the module responsible for updates that used the Regsvr32.Exe process to execute a malicious DLL.
the threat actor patched a Korean ERP solution to execute malware to maintain persistence... used the Regsvr32.Exe process to execute a malicious DLL. The DLL executed by this program was Xctdoor... attackers modified the installation file of BeeBEEP... to insert a routine that creates and executes Xctdoor
0X10016 Retrieve process list (PID, PPID, number of threads, process Path)
22 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A backdoor malware family distributed by the Larva-26005 threat actor and observed targeting users in Korea, including delivery disguised as an integrated security program.
Backdoor malware used against South Korean targets. It is delivered via droppers, LNK files, compromised servers, and trojanized installers; supports shell command execution, file operations, process management, keylogging, screenshots, clipboard/activity monitoring, system information collection, file upload/download, and C2-based remote control. It also monitors user absence status and can be injected into legitimate processes by XcLoader.
Backdoor malware delivered through malicious LNK resume-themed files. The infection chain uses embedded scripts, scheduled-task persistence, startup shortcut creation, additional file downloads, and DLL side-loading via a legitimate executable before injecting and executing Xctdoor, which then attempts to communicate with an external C2 server.
A named malware family identified as XCTDoor, described in the context of a North Korean-themed security installer lure and execution chain. The content implies it functions as a backdoor.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.