Loading story…
Security researchers reported multiple malware campaigns that disguised executables as document files to trick users into launching backdoors. In one case, attackers used a file named "2021년 국방부 업무보고 수정.pif" that appeared to be a revised South Korean Ministry of National Defense report; when opened, it displayed a legitimate PDF while silently dropping a malicious DLL to C:\ProgramData\Intel\Driver\driver.cfg, executing it with regsvr32.exe, and creating a scheduled task named Disk0 to run every 30 minutes. The payload was identified as a downloader that contacted command-and-control infrastructure for follow-on instructions.
A separate campaign used a malicious SCR file signed with a valid certificate from a well-known Korean company and presented with a PDF-like icon to reduce suspicion. After execution, the malware opened a decoy PDF from %TEMP%, extracted a DLL named config.dat into C:\Users\Public\, launched it with rundll32.exe, and deleted the original dropper. The backdoor then established persistence either through a MicrosoftEdgeInstaller service or a registry key, decrypted embedded configuration data with RC4 when needed, and connected to its C2 server to support file transfer, process execution, screenshot capture, configuration updates, and code injection.
Pull IOCs and campaign context straight into your stack.
5 events from the most recent confirmed update back to the earliest known activity.
ASEC identified malware distribution activity on January 24, 2021 using a file named "2021년 국방부 업무보고 수정.pif" disguised as a revised Ministry of National Defense work report. The executable displayed a decoy PDF while dropping a malicious DLL, establishing persistence with a scheduled task named "Disk0," and contacting command-and-control infrastructure.
ASEC reported that the malicious DLL dropped by the defense-themed lure had a compile timestamp of January 23, 2021. The DLL was later used as a downloader component executed via regsvr32.exe.
The Alyac report provided two IOC hashes and a C2 URL for the signed backdoor malware, and said AhnLab detected it as Trojan.Dropper.611828A and Backdoor.Agent.611828A. The analysis also documented RC4-decrypted configuration handling and supported backdoor commands such as file transfer, screenshot capture, and remote execution.
Alyac reported a malware campaign distributing a malicious SCR executable signed with a valid certificate from a well-known Korean company and disguised with a PDF-like icon. The malware dropped a decoy PDF and a DLL named config.dat, launched it with rundll32.exe, established persistence via a service or registry key, and connected to a C2 server for backdoor commands.
ASEC published technical details for the campaign, including V3 detections, two MD5 hashes, and two C2 URLs. The report described the malware's use of regsvr32.exe and scheduled-task persistence.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 9 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple Windows-focused malware campaigns were reported leveraging *trusted distribution and execution paths* rather than exploiting software vulnerabilities. One campaign attributed to **Larva-25012** disguised proxyware as legitimate *Notepad++* installers distributed via fake cracked-software portals and deceptive ads, primarily impacting South Korea. The payloads were hosted on GitHub and delivered as MSI/ZIP packages containing legitimate components plus malicious DLLs, using **DLL side-loading** and process injection into **Windows Explorer** to deploy proxyware (e.g., **Infatica** and **DigitalPulse**) for **proxyjacking**—monetizing victims’ internet bandwidth by reselling access through their networks. A separate multi-stage Windows malware operation used business-themed lures and weaponized archives containing **LNK** shortcuts to run hidden **PowerShell** with execution-policy bypass, pulling an obfuscated loader from GitHub and using legitimate services (e.g., **Dropbox**) to blend into normal traffic. Fortinet-reported tradecraft included persistence, decoy document generation, and beaconing via the **Telegram Bot API**, followed by defense evasion through abuse of **Defendnot** to disable Microsoft Defender before dropping follow-on payloads such as ransomware, banking trojans, and surveillance tooling. Additional reporting highlighted a broader trend of attackers abusing legitimate infrastructure and admin tooling (including **RMM** software after credential theft) to establish persistent access, while generic “common threats” content provided no incident-specific intelligence.
Jun 29, 2026
Multiple reports describe threat actors using *document-themed lures* to deliver malicious payloads while evading user scrutiny and defensive controls. ASEC-reported activity shows **weaponized PDF files** distributed via phishing (e.g., “Invoice,” “Payment”) that display a decoy image or a “Failed to load PDF document” error to push victims to click through to **fake Google Drive/Adobe pages**, ultimately installing legitimate **RMM tools** (e.g., *Syncro, SuperOps, NinjaOne, ConnectWise ScreenConnect*) signed with a valid certificate to blend in as administrative software rather than obvious malware. Separately, research on **APT36 / Transparent Tribe** details a targeted espionage operation against Indian government, academic, and strategic entities using spear-phishing ZIP attachments containing **oversized LNK files masquerading as PDFs**; execution chains leverage `mshta.exe` to retrieve remote HTA content, decrypt and reconstruct payloads in memory, and deploy a RAT (tracked as **ReadWriteRAT**) with capabilities including encrypted C2, remote command execution, screenshot capture, clipboard access, and data theft. Other items in the set cover unrelated threats—WordPress SEO cloaking that selectively serves malicious content to verified Googlebot IP ranges, a vendor blog overview of **Medusa** ransomware activity, and reporting on **CrazyHunter** ransomware impacting Taiwan healthcare—indicating the commonality here is *document/SEO deception techniques*, not a single unified incident.
Jun 29, 2026
FortiGuard Labs reported a high-severity cyber espionage campaign linked to North Korean state-sponsored actors that targets organizations in South Korea with phishing emails carrying malicious Windows `.lnk` files disguised as PDF documents. When opened, the shortcut launches PowerShell and other native Windows scripting tools while showing a decoy document, then performs anti-analysis checks for tools including Wireshark, Fiddler, x64dbg, Procmon, and `vmtoolsd`. Researchers said the operation has been active since at least 2024 and has evolved from earlier, less-obfuscated variants associated with XenoRAT into more sophisticated samples that embed decoding logic and payload data directly in the shortcut file. The malware establishes persistence through a Scheduled Task disguised as a technical paper and set to run every 30 minutes, then collects host data such as OS version, build number, process lists, and keep-alive logs. Operators used trusted GitHub accounts and private repositories as covert command-and-control and data-staging infrastructure, allowing malicious HTTPS traffic to blend with normal web activity while exfiltrating system information and retrieving follow-on instructions. Decoy filenames and metadata, including the "Hangul Document" naming convention, indicate deliberate targeting of South Korean companies and tradecraft aligned with clusters such as **Kimsuky**, **APT37**, and **Lazarus**.
Jun 29, 2026