Spear-phishing was the predominant delivery method observed against South Korean targets in July 2026, with malicious LNK files accounting for the largest share. The documented chains used PowerShell, AutoIt, HTA files, scheduled tasks, DLL side-loading, process injection, and trusted cloud services to deploy backdoors, information stealers, keyloggers, and XenoRAT. AhnLab tagged the report with Kimsuky, but the body does not directly attribute an individual chain or indicator to that DPRK-linked actor.