CTI · corroborated · 2026-10-10

ASEC July 2026 APT Attack Report (South Korea)

Full story & timeline

MITRE ATT&CK

• T1566 Phishing Initial Access
• T1204 User Execution Execution
• T1059 Command and Scripting Interpreter Execution
• T1053 Scheduled Task/Job Execution
• T1105 Ingress Tool Transfer Command and Control
• T1041 Exfiltration Over C2 Channel Exfiltration

Indicators

No curated indicators tied to this case.

Detections

Detection content derived from this case analysis. Status: experimental — not validated against live telemetry.

Sigma raw

title: Suspicious LNK File Launching PowerShell and AutoIt via Task Scheduler
id: a3c7e8f2-1d4b-4a9c-b5e6-7f8a9b0c1d2e
status: experimental
description: Detects LNK shortcut files that extract hex-encoded payloads to stage PowerShell and AutoIt binaries, followed by Task Scheduler persistence masquerading as OneDrive updates. Derived from ASEC July 2026 APT report on South Korean spearphishing campaigns.
references:
  - https://asec.ahnlab.com/en/95171/
  - https://malware.news/t/july-2026-threat-trend-report-on-apt-attacks-south-korea/125157#post_1
author: Tia N. List
date: 2026-08-28
tags:
  - attack.t1566.001
  - attack.t1059
  - attack.t1053
  - attack.t1105
logsource:
  category: process_creation
  product: windows
detection:
  selection_scheduled_task:
    EventID: 4698
    TaskName|contains:
      - 'OneDrive'
      - 'onedrive'
      - 'OneDriveUpdate'
  selection_autoit:
    EventID: 1
    Image|endswith:
      - '\AutoIt3.exe'
      - '\autoit3.exe'
      - '\SciTE.exe'
    ParentImage|endswith:
      - '\powershell.exe'
      - '\cmd.exe'
      - '\wscript.exe'
      - '\cscript.exe'
  selection_powershell_hex:
    EventID: 4104
    ScriptBlockText|contains:
      - 'ConvertFrom-HexString'
      - '[System.Convert]::FromBase64String'
      - 'Out-File -Encoding'
      - 'Invoke-Expression'
      - 'IEX('
      - 'Set-Content -Path'
  selection_pubnub:
    EventID: 1
    DestinationHostname|contains:
      - 'pubnub'
  condition: selection_scheduled_task or selection_autoit or selection_powershell_hex or selection_pubnub
falsepositives:
  - Legitimate AutoIt deployments
  - Standard OneDrive update mechanisms
level: high

References

• https://asec.ahnlab.com/en/95171/
• https://malware.news/t/july-2026-threat-trend-report-on-apt-attacks-south-korea/125157#post_1