Weaponized PDFs and LNK Files Used in Windows Attacks

GBHackers reports a clandestine campaign in which threat actors weaponise a legitimate-looking PDF titled “국가정보연구회 소식지 (52호)” alongside a malicious Windows shortcut file named 국가정보연구회 소식지(52호). When victims open the LNK file, a PowerShell payload silently downloads and runs additional malware to gain foothold, with in-memory execution and fileless techniques used to load the final payload.

The principal targets appear to be individuals connected with the National Intelligence Research Association, including academics, former government officials, and researchers, with the aim of stealing sensitive information, establishing persistence, and conducting long-term espionage, according to Seqrite Lab which has dubbed the operation HanKook Phantom.

Infections leverage a decoy PDF and a loader binary, and exfiltrate documents to a hardcoded C2 endpoint at daily.alltop[.]asia, while also using cloud services such as Dropbox, pCloud, and Yandex[.]Disk to host C2 channels as part of the campaign led by APT-37, a North Korean state-sponsored group active since at least 2012.

The report notes that APT-37 typically targets South Korea but has also affected other regions, and urges defenders to monitor LNK-based threats and in-memory execution patterns to mitigate this evolving threat. 29 August 2025.