Analysis of NodeLinkRAT, a New North Korea-Linked RAT Abusing Public Note Services as C2

◈ Key Findings

• Reply-based spearphishing impersonating a senior aide in a National Assembly member's office under the pretext of paying a seminar honorarium
• A multistage fileless chain involving LNK, PowerShell, free web hosting, and aNotepad
• Different second-stage code delivered on each C2 connection to hinder analysis and repeated collection
• Installation of XenoRAT or NodeLinkRAT by replacing code on a public note page
• The need to retain logs from initial execution and use behavior-based EDR detection

1. Executive Summary 

Between September 12 and 18, 2026, a threat actor impersonating a senior aide in a South Korean National Assembly member's office conducted a spearphishing attack against an attendee of a September 9 seminar, using an "honorarium payment application form" as a lure.

The actor deliberately omitted the attachment from the first email to prompt a reply from the victim, then delivered an archive containing a malicious LNK file through the large-attachment feature of a South Korean webmail service.

The second-stage script downloaded when the LNK file runs establishes persistence through a scheduled task. It uses a public note service as an additional C2 channel by periodically downloading and executing malicious scripts posted there by the threat actor.

The code posted on the note page evolved from running XenoRAT in memory to collecting information through cloud storage services such as Dropbox and MEGA and exfiltrating document files. It ultimately shifted to installing the Node.js runtime and running a JavaScript-based remote access tool.

Genians Security Center (GSC) named this remote access tool NodeLinkRAT.

The attack resembles the activities of North Korea-backed hacking groups in its TTPs, infrastructure preferences, and lure themes. In particular, the actor can switch attack tools simply by changing the contents of the note page, making it difficult to understand the full attack from code or C2 addresses observed at a single point in time.

2. Background

In September 2026, a spearphishing email impersonating a senior aide in a National Assembly member's office was observed. The screenshot below shows the email the victim actually received.

[Figure 2-1] Spearphishing Email Impersonating a National Assembly Member's Office and Requesting Honorarium Documents

The email subject is "[Office of Assembly Member OOO] Request for Documents for the September 9 Seminar Honorarium". The sender's display name is "OOO, Senior Aide". The victim had actually attended the September 9 seminar.

The first email arrived at 18:49 on September 12. It begins by thanking the recipient for attending the seminar, then asks them to complete and return the honorarium payment application form being sent. However, the email contains no attachment. This was deliberate, not a mistake.

The next day, the victim replied, "There is no attachment". This was the response the threat actor had been waiting for. Having effectively requested the file first, the victim would open the subsequent attachment without suspicion.

The threat actor sent a second email saying, "I am sending the attachment again". It used the webmail service's large-attachment feature, and the file was named "사례비 지급 신청_개인정보 동의서.zip" (Honorarium Payment Application_Personal Information Consent Form).

The archive contains "사례비 지급 신청_개인정보 동의서.hwp.lnk", disguised as an HWP document. The shortcut extension is hidden by default, so only ".hwp" is visible. A small arrow also appears in the lower-left corner of the icon, which is worth checking. Note that shortcut icon settings can be changed through registry policies.

[Figure 2-2] ZIP Archive and the LNK File It Contains

3. Threat Analysis

3-1. 사례비 지급 신청_개인정보 동의서.hwp.lnk

The extracted shortcut file, "사례비 지급 신청_개인정보 동의서.hwp.lnk", is disguised as an HWP document. In this case, however, the HWP icon does not display correctly under typical registry settings.

[Figure 3-1] Malicious LNK File

This is because the LNK file's icon path points to a remote GitHub server (norrisk983/hukushima) rather than a local location. Multiple servers hosting the same icon have been observed in similar attacks, making the icon resource useful for threat attribution.

Since the July 2024 Windows security update, the use of shortcut icons from remote paths has been restricted by default. The threat actor appears not to have fully understood this change.

However, the icon specified at the remote path is displayed in environments where the EnableShellShortcutIconRemotePath registry policy is enabled.

[Figure 3-2] Icon Hosted at the Remote Address

The commands identified in the LNK properties share a common structure: they use "cmd.exe" to launch PowerShell minimized and hidden, then reconstruct and execute commands obfuscated through character substitution.

The reconstructed commands use "curl.exe" to download PowerShell code from an external C2 server and immediately execute it through "Invoke-Expression".

[Figure 3-3] Commands in the LNK Properties

The variable names, substitution identifiers, character mapping arrays, identifier strings, and URL parameters used for obfuscation differ across variants. However, similar variants share the same core behavior: reconstructing commands, downloading code from an external server, and executing the downloaded code.

In the full shortcut target command shown below, the middle of the obfuscated string has been omitted for readability, and some values have been partially masked.

The command can be divided into five main components. First, "cmd.exe" launches PowerShell in a minimized, hidden window. The variable $Jv holds a string concealed with substitution identifiers, while the array $JP holds the ASCII codes used to reconstruct it. A loop converts each identifier back into a character to reconstruct the command, which the final "iEX" executes in memory.

The obfuscated string uses substitution identifiers from "z0" to "z13", each corresponding to an ASCII code stored in a separate array. 

[Table 3-1] Components of the LNK Command

During execution, each substitution identifier is replaced with its corresponding character to reconstruct an executable PowerShell command. 

[Figure 3-4] Script Returned on a C2 Connection

This script is a PowerShell-based second-stage loader that initially runs only in memory without being saved to disk. The first variable stores hex-encoded ciphertext, and the second stores an XOR key consisting of 256 alphanumeric characters.

The PowerShell code reconstructed through XOR operations configures TLS 1.2 for HTTPS communication, then decodes two Base64-encoded strings.

It uses ".substring(12)" and ".substring(10)" to remove the first 12 and 10 characters from the respective strings before Base64 decoding. This obfuscation technique conceals the actual code.

The reconstructed code creates a VBScript file ("j1u3uIqPQeRHnA.Jcu") and a PowerShell script ("UPA.ps1") in "%APPDATA%". It then registers a scheduled task named "CommonMaintenanceHost". Starting one minute later and repeating every 38 minutes, "wscript" executes the ".Jcu" file as VBScript, which in turn runs "UPA.ps1" in a hidden window.

[Figure 3-5] PowerShell Code Reconstructed Through XOR Operations

The second-stage code also identifies the original LNK file by searching for a file between 51,200 and 56,200 bytes in the current path, "Downloads", and "%TEMP%", in that order. It then locates the delimiter string "Akcq39XFG5uEOZbN" inside the file, extracts the data following it, saves the data under the original filename with ".lnk" removed, and opens the resulting file.

When the legitimate HWP form opens, the user believes the document has opened normally, while the original LNK file is deleted. The execution path and search results are logged to "%APPDATA%\zybJ0F.txt" during this process.

The HWP document serves as a decoy disguised as an actual honorarium payment application form, displaying the screen shown below.

[Figure 3-6] Legitimate HWP Decoy Document

The decoy document includes fields for the victim's name, bank name, and account number. If the victim completes and returns it, sensitive personal information may be delivered directly to the threat actor.

After execution, "UPA.ps1" waits for a random interval of up to approximately 10 minutes, then connects to an online note-sharing service used as an additional command channel (C2) to download data.

It then extracts, decodes, and executes Base64 code hidden between specific marker strings. The detailed behavior is described below.

[Figure 3-7] Online Note Service Used as an Additional Command Channel

anotepad[.]com is a legitimate online note-sharing service that allows users to create, save, and share notes on the web. The threat actor has repeatedly abused it as a C2 communication channel.

The threat actor posts Base64-encoded malicious code enclosed in marker strings on the service and frequently changes the note contents to switch the additional malware or attack commands.

Similar cases have involved the abuse of other online note-sharing services, including notepal[.]me and hypernotepad[.]com, for malware distribution and C2 communication.

After downloading the aNotepad page contents, "UPA.ps1" uses the regular expression "(?<=887wgJs8)(.*?)(?=nfJgcBl)" to extract only the string between the start marker "887wgJs8" and the end marker "nfJgcBl".

The extracted string undergoes HTML decoding and Base64 decoding before being executed in memory with "IEX".

The Base64 string and markers on the note page can change over time. The actor sometimes inserts fake addresses instead of the actual C2 address into the note to hinder analysis. Typos have also been observed in parts of the "UPA.ps1" code; in these cases, decoding errors may prevent the third-stage code from running.

[Figure 3-8] Base64 Extraction Command in "UPA.ps1"

The decoded Base64 content performs various malicious actions according to the threat actor's intent.

3-3. Attacks Through the Note Page

The commands reconstructed from the Base64 strings on the note page changed multiple times across collection dates.

GSC collected multiple third-stage code samples between June and October 2026. The attack tools changed in sequence from XenoRAT to information collection and exfiltration scripts, document theft scripts, and then NodeLinkRAT, a Node.js-based remote access tool.

[Table 3-3] Attacks Through the Note Page

3-3-1. In-Memory Execution of XenoRAT (June 18, 2026)

The first code observed contained an entire PE file converted into a string of decimal numbers. The script converts this string into a byte array, loads it into memory with "[System.Reflection.Assembly]::Load", and directly calls its entry point (EntryPoint).

Because the executable is not written to disk, it can evade file-based detection.

[Figure 3-9] XenoRAT C2

The reconstructed PE is a .NET-based XenoRAT variant. Although its namespace has been changed to MSOfficeServer, its handler structure and method organization match those of the open-source XenoRAT client.

Its C2 address is 103.81.116[.]10. The version information includes a Microsoft copyright notice and "Updater.exe" as the original filename to disguise it as a legitimate program.

This code was observed approximately three months before the September spearphishing attack. It shows that the same note infrastructure was already in operation and that other targets may have been attacked before this email was sent.

3-3-2. Dropbox-Based Information Collection and Exfiltration (September 18, 2026)

On September 18, three Base64 blocks were posted consecutively on the note page. Decoding the three blocks revealed identical code except for the Dropbox upload folder names. These names appear to be identifiers distinguishing victims A, B, and C.

The collection script gathers installed antivirus products, operating system information, the output of "ipconfig /all", a drive list, and a list of running processes. It also checks whether Telegram Desktop is installed and lists files under "C:\Users" modified within the past 24 hours.

The script obtains an access token using a hardcoded Dropbox app key and refresh token, then uploads the collected results to "/[victim identifier]/[internal IP]/[collection time]_info.log". The local log file is deleted after upload.

The script contains a field labeled "Vaccine Information" and Korean output strings such as "텔레그램 폴더가 존재합니다". In South Korea, "vaccine" is a commonly used term for security products.

The presence of code for multiple victims on a single note page shows that the threat actor managed several victims simultaneously through one channel.

Because "UPA.ps1" executes only the first block matched by the regular expression, each victim's PC would execute only its assigned block if different markers were used for each block.

[Figure 3-10] Code for Information Collection and Exfiltration to Dropbox

However, because the threat actor continually changed the scripts delivered by the C2 server, different versions of "UPA.ps1" with victim-specific markers may have been distributed.

The possibility that victim-specific code was selected and executed through another, unconfirmed method cannot be ruled out. In either case, the threat actor can independently adjust the attack stage for each victim simply by changing the note contents.

3-3-3. Information Exfiltration Through MEGA Cloud (September 27, 2026)

On September 27, code was observed that retained the collection functionality but changed the exfiltration channel. Its collection targets and output format were nearly identical to those of the September 18 code, but it had been modified to send the results file to MEGA cloud instead of Dropbox.

MEGA (mega[.]nz) is a cloud storage service that provides substantial storage capacity with a free account. The attacker focused on its official command-line tool, MEGAcmd. It can handle login and file uploads through commands without a graphical interface, making it easy to incorporate directly into scripts.

The script first checks whether MEGAcmd is installed. If it is not, the script downloads the installer from the official distribution address and installs it in an unattended mode that goes unnoticed by the user. It then starts the background service, logs in with the account specified in the code, and uploads the collected log file to the designated folder. Immediately after upload, it logs out and deletes the local log file to reduce traces.

This approach serves the same purpose as the earlier Dropbox case. Because communication is with a legitimate cloud service, it is difficult to stop the activity through domain or IP blocking alone, and the activity does not trigger alerts in environments where the service is permitted for business use. MEGAcmd itself is also a legitimately signed program, so file-based scans do not flag it. However, if "%LOCALAPPDATA%\MEGAcmd" suddenly appears on a PC that does not normally use MEGA and "MEGAcmdServer.exe" runs hidden, this is a clear sign of a potential compromise.

3-3-4. Dropbox App Replacement and Document Exfiltration (September 28, 2026)

On September 28, four code samples were observed on the note page. Three retained the information collection structure of the earlier code but used new Dropbox app keys. Different apps or tokens were assigned to each victim, which appears intended to preserve exfiltration channels for other victims even if some apps or tokens are blocked.

One of these variants was modified to list recently used documents (shortcuts in the "Recent" folder) instead of files modified within the past 24 hours. However, the code to write the query results to the log file is missing, so this information is not actually exfiltrated.

The remaining sample is a script that steals document files themselves rather than collecting information. Its exfiltration channel also changed from Dropbox to oppsite.dothome.co[.]kr, a South Korean free web hosting service.

The script searches the entire user profile folder for document and image files created or modified after a reference time. Targeted extensions include "doc", "docx", "xls", "xlsx", "ppt", "pptx", "pdf", "txt", "hwp", "jpg", "jpeg", "png", "gif", "bmp", "tiff", and "webp".

The files found are uploaded individually to "oppsite.dothome.co[.]kr/[identifier]/index.php".

[Figure 3-11] South Korean Free Web Hosting Used as C2

The reference time is stored in "%APPDATA%\ts.txt". On its first run, the script searches for files from the previous 24 hours. After uploading, it updates this file with the current time, so subsequent runs exfiltrate only files newly created or modified since then.

Because "UPA.ps1" re-executes the note page contents every 38 minutes, documents the victim is working on are exfiltrated in near real time while this code remains posted.

3-3-5. NodeLinkRAT, a Node.js-Based Remote Access Tool (October 16, 2026)

On October 16, a completely different type of code was deployed. Earlier code had collected information using PowerShell alone or loaded the .NET-based XenoRAT malware into memory. This code instead installs Node.js, a legitimate development tool, directly on the victim's PC and uses it to run a remote access tool written in JavaScript.

GSC named this malware "NodeLinkRAT". The name reflects how it runs on a legitimate Node.js runtime and turns an infected endpoint into a node that remains connected to the attacker's C2 server.

The script first downloads the Windows runtime archive ("node-v24.21.0-win-x64.zip") from the official Node.js distribution site (nodejs.org). The archive is saved in the "%TEMP%" folder under a randomly generated name consisting of three English letters. The download progress bar is suppressed to make the activity less noticeable to the user.

The downloaded file is extracted to "C:\Users\Public\Music", and the folder is renamed from "node-v24.21.0-win-x64" to "njs". After installation, the temporary archive is deleted. Users rarely check the public Music folder, making it a suitable location for hiding malicious files.

The script then installs three packages using npm, the Node.js package manager. socket.io-client provides real-time exchange of commands and results with the C2 server, screenshot-desktop captures the victim's screen, and ps-node lists running processes. The installation commands run through "cmd.exe" in a hidden window, so no window appears on screen.

Once installation is complete, the script creates an empty file named "C:\Users\Public\Music\unins000.dat". This file marks completion of the installation. If it exists on the next run, the script skips the Node.js download and package installation steps. This prevents installation from repeating even though "UPA.ps1" re-executes the note page contents every 38 minutes. The filename "unins000.dat" matches the name of an uninstall information file used by ordinary programs, making it easy to mistake for a legitimate file if discovered.

Next, the script decodes the Base64-encoded JavaScript code embedded within it and saves it as "C:\Users\Public\Music\teamview.js". If the file already exists, it is not recreated. Finally, the previously installed "node.exe" runs "teamview.js" in a hidden window, placing the victim's PC under the C2 server's remote control.

The filename "teamview.js" evokes TeamViewer, a widely used legitimate remote support program. This appears to be an attempt to disguise the tool so that any discovered traces of remote control are mistaken for those of a legitimate remote support tool.

This approach also favors the threat actor in terms of detection. The process that actually runs is "node.exe", an officially signed, legitimate program, while the malicious functionality resides in a separate JavaScript file. The runtime and packages are also downloaded from official sites and repositories, making it difficult to determine maliciousness from download addresses alone.

[Figure 3-12] Node.js Installation and Base64 Decoding

NodeLinkRAT connects to 207.148.112[.]166:3000 through Socket.IO and registers a client identifier along with the hostname, operating system, and architecture information.

It then follows C2 commands to execute commands, browse directories, download and upload files, delete files and folders, compress and exfiltrate folders, and capture the screen in real time.

[Figure 3-13] C2 Server Address Specified in "teamview.js"

Communications are encrypted with AES-256-GCM, but the key is hardcoded as "12345678901234567890123456789012", allowing the communications to be decrypted if network traffic is captured.

It also uses ps-node to check whether the same script is already running and prevent duplicate execution. Because "UPA.ps1" re-executes the note page contents every 38 minutes, the RAT restarts even if it is terminated.

The RAT includes a client identifier used to distinguish targets. This value is identical to the one used in the upload path of the September 28 document exfiltration script.

A developer comment reading "반드시 변경할 것(must change)" remains beside this value in the code, suggesting that the tool was built with a different identifier for each target. The shared identifier across two tools using different languages and C2 servers shows that the two stages operated sequentially within a single target management system.

The threat actor maintained a single note-page channel while replacing only the third-stage code to switch among XenoRAT, information collection scripts, document exfiltration scripts, and NodeLinkRAT. Exfiltration channels also changed frequently among the actor's own C2 servers, Dropbox, free web hosting, and MEGA cloud.

These frequent changes to the final payload and C2 make it difficult to understand the full attack from code or C2 addresses observed at a single point in time. Detection should focus on the shared behavior of "UPA.ps1" periodically retrieving the note page and executing its contents in memory.

4. Threat Attribution

To assess attribution for this campaign, GSC cross-analyzed attack infrastructure registration records, infrastructure overlaps with previous cases, malware build fingerprints and configuration values, and the types of services preferred by the threat actor.

4-1. Exfiltration Infrastructure Registration Details

GSC focused on the registration details of a Dropbox account identified in a similar case that used anotepad[.]com as a command channel. The account used "Christopher" as its display name and c0653159@gmail[.]com as its registration email address.

[Figure 4-1] Dropbox Account Registration Details

The information collection script in this campaign contains a hardcoded Dropbox app key and refresh token, which it uses to obtain an OAuth access token and upload the collected results. This approach requires the threat actor to create and operate its own account, making account registration details more valuable for tracking than information about C2 servers that can be rented anonymously.

The Gmail address was confirmed to have been used in phishing attacks targeting people working on North Korean affairs in South Korea in 2025. This shows that the operator of this campaign shares account assets with an actor that previously conducted intelligence collection activities against South Korea.

4-2. Phishing Page Layout and C2 Network Overlap

The page impersonating a NAVER MYBOX security notification identified in this case is nearly identical in layout to a phishing page observed in 2024. The infrastructure used at that time was inmain.22web[.]org (185.27.134[.]207) and owna.loveslife[.]biz (185.27.134[.]120), both within the 185.27.134[.]0/24 subnet.

[Figure 4-2] Phishing Email Disguised as a NAVER MYBOX Security Notification

The identical phishing page layouts indicate reuse of the same phishing kit, while the concentration of C2 servers in the same subnet indicates repeated use of the same hosting provider. When observed together, these factors support an assessment of asset reuse rather than simple imitation of techniques.

In its December 2024 report, "Analysis of the Kimsuky Threat Actor's Email Phishing Campaign", GSC attributed that phishing campaign to the Kimsuky group.

4-3. Comparison of XenoRAT Variant Build Fingerprints

Three XenoRAT variants were identified in this attack. Two use 103.81.116[.]10 in India as their command server, while the third uses 211.223.14[.]75 in South Korea. All communicate over port 443. Because XenoRAT is open source and can be built by anyone, its use alone provides limited attribution value. However, its continued adoption by North Korea-linked groups warrants attention.

This campaign also uses the same execution framework: LNK files disguised as documents, obfuscated PowerShell, payload delivery through legitimate services, and scheduled task-based persistence. The binary comparison of the three variants is shown below.

First, all three variants share MSOfficeServer as their AssemblyTitle and the same assembly GUID, 200b1ad6-f1ff-49de-aa9c-b07d2615cdec.

An assembly GUID is assigned once when a development project is first created and remains unchanged in subsequent builds. This GUID does not match that of the publicly available XenoRAT client project. It therefore shows that the threat actor reorganized the public source code into a separate project rather than simply building it as published, and that all three variants were produced from that single project.

Next, two variants share the fixed Mutex value "IbfXgQPt20kszwAzuy85BJIKr0IrJUs2". This value is passed as an argument to the Mutex constructor to prevent duplicate execution. It is a custom value that differs from the default string used by the original XenoRAT.

Because this value is 32 characters long, it can easily be mistaken for XenoRAT's communication encryption key (byte[32]). The actual encryption key exists as a separate byte array. All three variants share the same custom key, which differs from the original default.

[Figure 4-3] Internal XenoRAT Function

4-4. Abuse of a Free Domain Service

NodeLinkRAT uses the Japan-based host 207.148.112[.]166 as C2. It also sometimes uses nid.weffm.p-e[.]kr, an address created through a South Korean free domain service.

[Figure 4-4] C2 Web Server in Japan

The p-e[.]kr domain used by this address is a subdomain of the free domain service offered by "내도메인[.]한국". The service allows users to obtain domains and frequently change DNS records without fees or complex procedures. It is known to have been repeatedly abused by North Korea-linked hacking groups.

Together with the previously identified Dothome (dothome.co[.]kr) free web hosting service, the use of a domain structure familiar to South Korean users can be interpreted as an attempt to reduce recipients' suspicion.

In particular, "nid" directly borrows the beginning of NAVER's account login domain (nid.naver[.]com), making it easy for a recipient scanning the address quickly to mistake it for a legitimate NAVER domain.

4-5. Credential Theft Infrastructure

The server exposed files used to build phishing pages for stealing NAVER email account credentials.

[Figure 4-5] Files for NAVER Login Phishing

This shows an operating model that combines endpoint compromise through malware with account theft through phishing. Gaining access to a victim's email account can provide contacts for additional targets and the contents of actual business emails. These can serve as a basis for producing further credible lures, such as the reply-based spearphishing used for initial access in this campaign.

4-6. Assessment of Attribution Evidence

It is difficult to establish attribution based on individual factors alone. XenoRAT is open source, and Dropbox and free hosting are commonly abused by many threat actors. However, the account assets, phishing kit, and C2 subnet partially overlap with past Kimsuky activity. Combined with the malware variants built from a single project and matching target selection characteristics, these factors provide sufficient grounds for a connection.

GSC therefore assesses this campaign as the work of the North Korea-linked threat group Kimsuky, with moderate confidence. This means that multiple independent lines of evidence directly overlap with past activity, but no single decisive piece of evidence has been obtained.

The following limitations were also considered. First, much of the attack infrastructure consists of public services, so the possibility that a third party imitated the same techniques cannot be completely ruled out.

Second, the use of Korean strings and South Korean services may reflect the targeting of South Korea, and deliberate deception is also possible.

Third, the threat actor frequently changed the code on the note page, so there may be attack stages that have not been identified.

Finally, changes in the organizational affiliation or primary mission of North Korean threat actors may result in partial overlap or confusion with their previous campaigns. GSC will continue tracking related infrastructure and code to refine this assessment.

5. Conclusion

5-1. Campaign Conclusion

This attack is assessed as a cyberespionage operation in which a North Korea-linked threat group approached South Korean policy and security professionals through reply-based spearphishing, then used a public note service as a command channel to continually replace its attack tools.

From June to October 2026, the threat actor deployed XenoRAT, information collection scripts, document theft scripts, and NodeLinkRAT in sequence simply by changing the code on the note page. Exfiltration channels also changed frequently among the actor's own C2 servers, Dropbox, MEGA cloud, and South Korean free web hosting.

Notably, NodeLinkRAT, identified in the final stage, runs on a legitimate Node.js runtime downloaded from the official site. The packages used for communication and screen capture are also installed from the official npm registry. Because the running process is a signed, legitimate program and its download sources are legitimate sites, it is difficult to determine whether the activity is malicious based solely on filenames, process names, or destination domains.

Because the attack is carried out entirely through legitimate services and tools, detection must be based on relationships between behaviors rather than individual events.

5-2. Integrated Response Strategy with "Genian Insights E"

This campaign builds trust with targets through reply-based spearphishing, then distributes multistage PowerShell scripts through LNK files disguised as HWP documents.

The attack continues with scheduled task registration, command retrieval through a public note service, system information collection and document exfiltration, and installation of a remote access tool. Effective detection requires connecting and analyzing the following sequence of anomalous behaviors as a single attack flow.

• Execution of an LNK file disguised as an HWP document inside an archive
• Sequential execution of "cmd.exe", "powershell.exe", and "curl.exe" initiated by the LNK file
• Downloading a script from free web hosting and executing it in memory with "iex"
• Creation of a PowerShell script and a VBScript file with a disguised extension in "%APPDATA%"
• Registration of scheduled tasks disguised as legitimate maintenance tasks, such as "CommonMaintenanceHost"
• Anomalous repeated script execution at one-minute or 38-minute intervals
• Script execution using a PowerShell execution policy bypass and hidden windows
• Periodic connections to a public note service followed by in-memory execution of the response contents
• Bulk collection of system information, including antivirus products, "systeminfo", "ipconfig", and running process lists
• Uploads to external cloud storage using the Dropbox API and MEGAcmd
• Repeated transfer of document and image files to external web hosting
• Downloading the runtime from nodejs.org, installing it in "C:\Users\Public\Music", and installing npm packages
• Execution of a ".js" file in a public folder by "node.exe" in a hidden window
• Removal of traces by deleting temporary files and the original LNK after information transfer
  
  

Genian Insights E correlates endpoint events, including process trees and command lines, file creation, scheduled tasks, registry activity, and network connections. This makes it possible to visualize LNK execution, public note service access, PowerShell execution, and scheduled task registration as a single attack flow, even though each may appear legitimate in isolation.

Even when legitimately signed tools such as the Node.js runtime or MEGAcmd are installed, filenames or signatures alone should not be used to determine legitimacy. The process performing the installation, the installation path, the scripts executed by the tool, scheduled task registration, and anomalous external communication must be examined together.

Rather than indiscriminately blocking access to Dropbox, MEGA, public note services, and free web hosting, analysis should consider the accessing process and command line, file creation paths, API usage, and subsequent execution behavior together. When legitimate services permitted for business use are abused as attack infrastructure, correlating behaviors is more important than detection based solely on domains or IP addresses.

Even if generative AI improves the quality of phishing messages and decoy documents, it cannot conceal endpoint behaviors such as script execution, persistence, information collection, and external transmission. An integrated response framework centered on EDR is therefore needed to continually incorporate the latest indicators of compromise, analyze relationships between attack stages, and rapidly block anomalous behavior.

The screenshots below show Genian Insights E detecting the initial access stage of this campaign. The following sections examine, in sequence, how each stage is identified, from the archive delivered through spearphishing and execution of the LNK file inside it to the subsequent C2 communication by "curl.exe".

[Figure 5-1] Identification of Initial Access Through Spearphishing

The Attack Storyline feature in Genian Insights E visualizes the attack flow from the initial access stage through the spearphishing email. The point at which the victim downloads "사례비 지급 신청_개인정보 동의서.zip" delivered through the webmail service's large-attachment feature, extracts it, and executes the LNK file inside is identified as the start of the attack.

At this stage, the delivery path, downloaded filename, and extraction location are recorded together, allowing subsequent PowerShell execution and external communication to be traced back to the originating file. Even while the user believes they have opened a legitimate HWP document, EDR retains logs from the initial execution. These logs allow the compromise to be reconstructed after the original LNK file has been deleted.

[Figure 5-2] Detection of the Extracted Malicious LNK File

In this case, behavior-based XBA detection was triggered when the extracted "사례비 지급 신청_개인정보 동의서.hwp.lnk" file was executed. The command-line information directly shows how the command in the LNK properties launches PowerShell minimized and hidden through "cmd.exe". The fact that executing the shortcut leads to script execution rather than document viewing provides evidence of its disguise as an HWP document.

The detection summary presents the LNK file's storage path together with parent-child process relationships. This allows security administrators to quickly understand the threat's behavior and scope of impact and take necessary follow-up actions, such as investigating whether the same file has reached other endpoints.

[Figure 5-3] C2 Connection Attempt by "curl.exe"

The detected threat's execution flow shows "cmd.exe" launching "powershell.exe" in a hidden window, followed by "curl.exe" attempting external communication with a C2 server hosted on a free web hosting service (epaper.dothome.co[.]kr), as directed by the reconstructed command.

Correlating process execution information, external network communication, and command lines enables rapid tracing of how the threat actor delivered the second-stage payload through a legitimate hosting service, along with the detailed behaviors involved.

A closer investigation of the detected threat reveals the sequence of commands used in the attack through the full command line executed by "cmd.exe".

This makes it possible to understand the entire attack flow, from initial command execution through the arrival of external files and subsequent malicious behavior, rather than analyzing individual detection events in isolation.

EDR that continuously collects and analyzes endpoint behavior is needed to correlate activity before and after an APT attack, provide visibility, and rapidly trace the full threat sequence.

6. IoC (Indicator of Compromise)

• MD5

6985f297c03520a5852734a385322d8d

7575d230350299cfde0c4f993d761333

a151531b792b1df1eec8d3a6a8e1ded5

a15df586bf29e7c1a5db64d603cee382

cbcb66b530fb4f03d7dc9d55271b2ce4

ef317291bf88651666133abe84f115f0

• C2

103.81.116[.]10

211.223.14[.]75

207.148.112[.]166

185.27.134[.]207

185.27.134[.]120

• Domain

epaper.dothome.co[.]kr

oppsite.dothome.co[.]kr

nid.weffm.p-e[.]kr

inmain.22web[.]org

owna.loveslife[.]biz