ASEC observed that most domestic APT activity during September 2026 began with spear-phishing messages, with LNK files serving as the most prevalent execution mechanism. The documented chains used PowerShell, malicious AutoIt scripts, HTA files, scheduled tasks, and DLL loading through regsvr32 to establish persistence and deploy backdoors, information stealers, and keyloggers. One chain used PubNub channels for command execution and data exfiltration, while another downloaded additional payloads from GitHub and deployed XenoRAT.