Loading story…
AhnLab published a June 2026 threat trend report summarizing advanced persistent threat activity detected in South Korea through its monitoring infrastructure. The report compiles classifications and statistics for APT attacks observed in the country and outlines the capabilities associated with each attack type, providing a snapshot of the domestic threat landscape.
The available references indicate the report is a high-level assessment rather than a detailed disclosure of specific indicators, malware samples, or actor attribution in the excerpted material. Even so, the publication highlights continued monitoring of targeted intrusion activity in South Korea and frames the findings as part of AhnLab ASEC’s ongoing reporting on regional APT operations.
TTPs, infrastructure, and targeting history in one profile.
1 event from the most recent confirmed update back to the earliest known activity.
AhnLab reported on advanced persistent threat activity detected in South Korea during June 2026 using its monitoring infrastructure. The report summarizes classifications, statistics, and capabilities associated with the identified attack types.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 12 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
5 references tracked. Mallory keeps watching after this page renders.
bsky.app
Open sourcebsky.app
Open sourcemalware.news
Open sourceasec.ahnlab.com
Open sourceasec.ahnlab.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**Kimsuky**-linked malware delivered through malicious **LNK** files was observed targeting likely South Korean users, using shortcut execution to unpack a PowerShell-based implant, establish persistence via **Task Scheduler**, collect host information, and communicate through the **Dropbox API**. IIJ reported that the LNK extracts files into `C:\PerfLog`, deploys `www.ps1` and a VBScript launcher, creates a scheduled task named `P`, and drops a decoy document in a Hancom Office format. The malware generates a client ID from the victim MAC address, gathers system details including domain, username, OS version, process lists, and external IP address, then uploads the data to attacker-controlled Dropbox folders before attempting to download and run a follow-on batch payload. AhnLab's February 2026 APT trend reporting for South Korea provides broader context showing that **spear phishing** remained the dominant delivery method and that **LNK-based attacks** were the most prevalent format observed, including campaigns that used PowerShell to fetch additional components and register persistence. While AhnLab's report is a monthly trend overview rather than a dedicated write-up on the Dropbox variant, it aligns with IIJ's assessment that the malware shares substantial **TTP** overlap with previously reported **Kimsuky** activity. The reporting indicates continued abuse of legitimate cloud services such as **Dropbox** and, more broadly, GitHub and similar platforms to blend command-and-control and payload staging into normal network traffic.
Jun 30, 2026
North Korea-aligned threat actor **Kimsuky** has expanded operations across its **AppleSeed** and **PebbleDash** intrusion clusters, using spear-phishing documents to gain initial access and then deploying a broader malware set that includes **HelloDoor**, **httpMalice**, **MemLoad**, **httpTroy**, **AppleSeed**, and **HappyDoor**. Researchers assess with medium-high confidence that both clusters are operated by Kimsuky-affiliated actors, also tracked as **APT43** and **Ruby Sleet**, with AppleSeed showing a stronger focus on government organizations while PebbleDash activity has also reached defense-related entities in Brazil and Germany in addition to South Korean targets. The campaigns show a notable shift in post-compromise tradecraft, with operators increasingly abusing legitimate remote administration and tunneling tools such as **VSCode Remote Tunneling**, **DWAgent**, and **Cloudflare Quick Tunnels** for persistence and access. The report also notes malware development changes including the use of **Rust**, probable LLM-assisted code comments, and continued reliance on infrastructure patterns tied to free South Korean hosting domains and compromised South Korean websites, indicating that Kimsuky is modernizing its tooling while preserving long-standing operational habits.
Jun 29, 2026
ESET reported sustained global activity by China-, Iran-, North Korea-, and Russia-aligned threat actors across Q4 2025 and Q1 2026, with operations closely tied to geopolitical priorities. China-aligned groups targeted government, maritime, energy, and technology organizations in countries including Venezuela, Syria, Cambodia, Panama, and South Korea, and also abused **Ivanti VPN** environments. Iran-linked activity shifted during the late-February 2026 war in Iran: established APT operations declined, while proxy, hacktivist, and unattributed actors increased attacks against Israel and other perceived adversaries, including the use of destructive tooling described as a bootkit-style wiper. North Korea-aligned actors continued social-engineering and supply-chain campaigns aimed at developers and cryptocurrency ecosystems, including a Lazarus-linked compromise of the **`axios`** JavaScript library, while **Andariel** resurfaced in South Korea using **TigerRAT** and attempting ransomware deployment. Russia-aligned groups remained heavily focused on Ukraine, with **Sednit** targeting military and drone-related entities and **Sandworm** escalating destructive operations, including a December 2025 incident at a Polish energy company attributed with medium confidence. ESET also documented browser-in-the-browser phishing against a Japanese think tank, **Asin** Android spyware targeting Arabic-speaking users, and the compromise of a UAE defense company through a **SmartOffice CRM** server.
Jun 29, 2026