Threats · 206 days ago
DPRK-linked threat actors are combining region-specific document exploitation with commodity platforms to maintain stealthy, persistent access in South Korea. They use LNK phishing to deliver decoy documents in the Korean HWP format, which leverages OLE and DLL side-loading to increase social engineering success and evade detection. The attackers employ GitHub repositories as command-and-control (C2) infrastructure, blending malicious callbacks into legitimate traffic to avoid easy takedown and detection. This approach enables persistent footholds that survive reboots and can push remote access tools like RokRAT. Standard defenses focusing on patching or blocking known malicious domains miss this threat because GitHub traffic appears legitimate, LNK files with decoys bypass casual suspicion, and persistence mechanisms evade simple file-based detection. This campaign raises the espionage risk for organizations handling Korean-specific documents or with strategic ties to South Korea, and
1 source covering this story
DPRK-Linked Hackers Use GitHub as C2 in Multi-Stage Attacks Targeting South Korea
DPRK-linked actors use GitHub C2 and LNK phishing in South Korea, enabling persistent PowerShell control and data exfiltration.
Part of the PlainSec briefing for 2026-04-07