AhnLab observed May 2026 South Korea-focused APT activity dominated by spear phishing, especially malicious LNK attachments and some CHM files. The attack chains used PowerShell, CMD, XML, JS, VBScript, BAT files, AutoIt, HTA, Python, and legitimate Windows tools such as curl.exe, regsvr32.exe, certutil.exe, wscript.exe, mshta, and Task Scheduler to download payloads, maintain persistence, and run backdoors or infostealers. Reported payload behavior included command execution, file upload and download, directory querying, system information theft, keylogging, XenoRAT-type deployment, DLL side-loading, and Python backdoor communications with attacker infrastructure.