AhnLab observed June 2026 domestic APT activity delivered primarily through spear-phishing emails and malicious LNK files, and the source categorizes the analysis under Kimsuky. The documented chains used PowerShell, AutoIt, HTA files, GitHub-hosted payloads, scheduled tasks, DLL side-loading, and malicious Python components to establish persistence. Final payloads included XenoRAT, information stealers, keyloggers, and backdoors capable of executing commands, transferring files, collecting system information, and controlling infected hosts.