AhnLab's June 2026 monitoring found that APT attacks in South Korea predominantly began with work-themed spear phishing and malicious LNK files, and the source categorizes the activity under Kimsuky. The observed chains used PowerShell, AutoIt, curl, HTA files, scheduled tasks, GitHub or Google Drive payload delivery, DLL side-loading, and Python. Resulting payloads included information stealers, keyloggers, XenoRAT-type malware, and backdoors supporting command execution, file transfer, information theft, persistence, and remote control.