Analysis of the Connection Between Xctdoor and Past CRAT Attack Cases (Larva-26005)

1. Overview

AhnLab SEcurity intelligence Center (ASEC) recently confirmed that the Larva-26005 threat actor is distributing Xctdoor to users in Korea. Xctdoor was disclosed through the ASEC blog in 2024, and [1] In March 2026, Hauri disclosed an attack case in which the malware was disguised as an integrated security program. [2] While analyzing the attacks and malware used by the Larva-26005 threat actors, ASEC confirmed that Xctdoor is linked to past instances of CRAT malware distribution. CRAT was first identified in 2020 and was used in various attack cases targeting South Korean users, includi…