Loading story…
AhnLab Security intelligence Center (ASEC) reported that the Larva-26005 threat actor is actively distributing the Xctdoor malware to users in South Korea and has tied the activity to earlier CRAT attack cases. The report connects the current campaign to malware previously disclosed by ASEC in 2024, indicating continuity in tooling and operations rather than an isolated incident.
The activity also aligns with a separate March 2026 case disclosed by Hauri, where the malware was disguised as an integrated security program to lure victims into infection. The combined reporting suggests an ongoing social-engineering-driven malware campaign in South Korea in which Xctdoor is being reused or adapted alongside tactics seen in prior CRAT-related intrusions.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
ASEC reported that Larva-26005 continued targeting South Korean users in April, June, and July 2026 using malicious LNK files. The LNK lures displayed decoy documents while launching the same multi-stage downloader chain used in the earlier fake security software attacks.
Hauri disclosed an attack case in March 2026 involving Xctdoor. In that case, the malware was disguised as an integrated security program.
ASEC had previously disclosed the Xctdoor malware on its blog in 2024, establishing earlier public reporting on the malware family later tied to Larva-26005 activity.
ASEC confirmed that the Larva-26005 threat actor is distributing Xctdoor malware and targeting users in South Korea. The reporting links the current activity to past CRAT-related attack cases.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
6 references tracked. Mallory keeps watching after this page renders.
bsky.app
Open sourcebsky.app
Open sourcemalware.news
Open sourceasec.ahnlab.com
Open sourceasec.ahnlab.com
Open sourcehauri.co.kr
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers reported ongoing phishing activity by **Larva-24009**, a threat actor active since at least 2023, using email lures to compromise users and install malware. The campaign has targeted victims in **South Korea** as well as organizations and users internationally, with analysis published by AhnLab ASEC and echoed by other researchers including Cyble. The newly documented case adds to earlier disclosures from 2024 that linked the actor to similar email-based intrusion activity, indicating a sustained malware delivery operation rather than an isolated incident. Public reporting attributes the attacks to phishing emails crafted to trick recipients into opening malicious content, reinforcing the continued risk from socially engineered initial access campaigns aimed at broad regional and cross-border targets.
Aug 3, 2026
Recent reporting highlights multiple **social-engineering-driven malware delivery** efforts that culminate in remote access and persistent compromise. In South Korea, attackers distributed **counterfeit adult games** via popular “webhard” file-sharing services; victims received a ZIP containing a decoy `Game.exe` launcher that stages additional components (`Data1.Pak`, `Data2.Pak`, `Data3.Pak`) and ultimately injects **QuasarRAT** (aka **xRAT**), enabling host profiling, keylogging, and unauthorized file transfer. The execution chain included masqueraded artifacts such as `GoogleUpdate.exe` and `WinUpdate.db`, with AES used to decrypt/extract shellcode prior to privilege escalation and RAT injection. Separately, a spear-phishing campaign weaponized news about a purported **Nicolás Maduro arrest** to deliver a **backdoor**: emails carried a ZIP with a lure executable (`Maduro to be taken to New York.exe`) alongside a malicious DLL (`kuguo.dll`) that abuses a legitimate KuGuo binary for execution. Post-run behavior included replication to `C:\ProgramData\Technology360NB`, persistence via an auto-start renamed binary (`DataTechnology.exe`), and C2 beaconing for tasking and configuration updates; researchers noted tradecraft consistent with **Mustang Panda** but said attribution was not yet confirmed. A separate research note described **GravityRAT** reemerging as a multi-platform RAT with expanded **Android** targeting (in addition to Windows/macOS), emphasizing mobile endpoints as increasingly high-value targets for data theft and persistent access, though it did not describe the same specific campaigns as the Windows-focused lures above.
Jun 29, 2026
North Korea-aligned threat actor **Kimsuky** has expanded operations across its **AppleSeed** and **PebbleDash** intrusion clusters, using spear-phishing documents to gain initial access and then deploying a broader malware set that includes **HelloDoor**, **httpMalice**, **MemLoad**, **httpTroy**, **AppleSeed**, and **HappyDoor**. Researchers assess with medium-high confidence that both clusters are operated by Kimsuky-affiliated actors, also tracked as **APT43** and **Ruby Sleet**, with AppleSeed showing a stronger focus on government organizations while PebbleDash activity has also reached defense-related entities in Brazil and Germany in addition to South Korean targets. The campaigns show a notable shift in post-compromise tradecraft, with operators increasingly abusing legitimate remote administration and tunneling tools such as **VSCode Remote Tunneling**, **DWAgent**, and **Cloudflare Quick Tunnels** for persistence and access. The report also notes malware development changes including the use of **Rust**, probable LLM-assisted code comments, and continued reliance on infrastructure patterns tied to free South Korean hosting domains and compromised South Korean websites, indicating that Kimsuky is modernizing its tooling while preserving long-standing operational habits.
Jun 29, 2026