Threat Actors Exploit LNK Files to Deploy MoonPeak Malware on Windows Systems
## Cybersecurity: Malware Attack on Windows Users in South Korea
Cybersecurity: Malware Attack on Windows Users in South Korea
A sophisticated three-stage malware campaign has been identified targeting Windows users in South Korea via specially crafted LNK (shortcut) files.
The attack begins with a deceptive LNK file named "실전 트레이딩 핵심 비법서.pdf.lnk" (translated as "Practical Trading Core Secret Book"), aimed at South Korean investors. This approach leverages social engineering, presenting a decoy PDF file while executing a hidden PowerShell script.
Upon opening the LNK file, a decoy document is shown, while an obfuscated PowerShell script runs silently. The campaign, observed by Internet Initiative Japan (IIJ) in January 2026, utilizes multiple evasion techniques to deliver the MoonPeak malware, a variant of the XenoRAT remote access trojan.
The PowerShell payload checks for virtualization environments and over 50 analysis tools. If detected, execution is terminated to prevent analysis.
The malware creates temporary folders and files, establishing persistence via scheduled tasks with WScript.exe. The initial PowerShell script communicates with a command-and-control server at "hxxp://mid[.]great-site[.]net" to transmit system information.
A sophisticated three-stage malware campaign has been identified targeting Windows users in South Korea via specially crafted LNK (shortcut) files.
The second-stage script downloads an executable from a GitHub repository, using trusted platforms as delivery mechanisms, known as "Living Off Trusted Sites" (LOTS). This executable, MoonPeak malware, is heavily obfuscated to defeat static analysis.
Attribution indicators suggest DPRK-affiliated operators. The malware's capabilities remain consistent with past campaigns, demonstrating a focus on financial targets.
Organizations should monitor LNK file execution, implement application whitelisting, and restrict PowerShell execution. Endpoint detection and response solutions should alert on scheduled task creation and unusual GitHub API access. Monitoring GitHub repositories and rapid takedown protocols are critical for disrupting distribution.
SHA256 Hash File Name
1553bfac012b20a39822c5f2ef3a7bd97f52bb94ae631ac1178003b7d42e7b7f 실전 트레이딩 핵심 비법서.pdf.lnk
aaac6eadac6c325bfc69b561d75f7cfd979ac289de1cc4430c5cc9a9a655b279 octobor.docx
8de36cb635eb87c1aa0e8219f1d8bf2bb44cad75b58ef421de77dd1aae669bf4 Stella.exe
Based on reporting by GBHackers.