Executive Summary
FortiGuard Labs has identified a sophisticated campaign attributed to North Korean state-sponsored groups (suspected Kimsuky, APT37, or Lazarus) targeting South Korean entities. The attack chain utilizes malicious LNK files disguised as legitimate PDF documents, such as strategic proposals or confidential agreements, to initiate a multi-stage infection process.
Technically, the campaign has evolved from simple obfuscation to embedding XOR-decoding functions directly within LNK arguments to drop decoy PDFs and PowerShell scripts. The malware establishes persistence via scheduled tasks and utilizes GitHub's API for exfiltrating system data and receiving further instructions. By leveraging GitHub as C2 infrastructure, the attackers successfully bypass traditional network security filters that typically whitelist high-reputation domains.
This campaign underscores the ongoing threat posed by DPRK actors who prioritize native Windows tools (LolBins) and legitimate public infrastructure to minimize their footprint. The targeting of financial and technological sectors in Korea suggests an intent to expand surveillance and potentially conduct follow-on data theft operations.