AhnLab linked recent Xctdoor distribution tracked as Larva-26005 to CRAT attacks against South Korean users dating to 2020, which other security firms attributed to Lazarus. Shared AppX installation paths, runtime code-obfuscation methods, and the earlier co-deployment of CRAT, Xctdoor, and Hansom ransomware support the connection. In 2026, the actor delivered C++ and Go Xctdoor variants through fake Veraport and SoftCamp installers and malicious LNK files, while related 2024 activity involved compromised IIS servers, groupware upload pages, ERP update components, and a trojanized BeeBEEP installer. Xctdoor provides shell access, file transfer, process control, keylogging, clipboard monitoring, screenshots, and in-memory payload injection.