Operation HanKook Phantom: APT-37 Targets South Korean Institutions with LNK-Based Espionage Campaign

Researchers at Seqrite Lab have uncovered Operation HanKook Phantom, a spear‑phishing campaign attributed to APT‑37 (ScarCruft / InkySquid / Reaper) that uses malicious LNK files embedded in decoy documents to infiltrate South Korean government bodies, universities, and research organisations. The attack begins with a PDF titled “국가정보연구회 소식지 (52호)” accompanied by a malicious LNK file, and once the LNK is executed, a payload is downloaded or executed to compromise the system, according to Seqrite.

The LNK file hides PowerShell scripts that drop payloads such as aio1.dat and aio02.dat in the temp directory, with an XOR‑encrypted binary decrypted in memory for a fileless execution via reflective DLL injection, culminating in a variant of ROKRAT that can gather system information, capture screenshots and exfiltrate files.

Seqrite notes that a second wave used a statement by Kim Yo‑jong as bait, with another malicious LNK file and in‑memory execution of a final payload, exfiltrating data via multipart/form‑data HTTP POST requests disguised as PDF uploads. Targets include the National Intelligence Research Association, Korea University and Kwangwoon University, the Institute for National Security Strategy, the Ministry of Unification, and related organisations across multiple countries.

According to Seqrite, the campaign demonstrates the persistence of North Korean‑backed espionage and the evolving use of LNK‑based delivery and cloud services for C2.