LNK shortcut files were the leading delivery format among APT attacks AhnLab detected against South Korean targets in July 2026. The documented infection chains used PowerShell, AutoIt, HTA files, scheduled tasks, DLL side-loading, GitHub, Google Drive, Dropbox, and Python-based backdoors. Successful infections could deploy information stealers, keyloggers, XenoRAT-type malware, and other backdoors to collect system data, virtual-asset information, and command-execution results.