Executive Summary
AhnLab Security intelligence Center (ASEC) has identified recent campaigns by the Larva-26005 threat actor, who is distributing Xctdoor and XcLoader malware primarily to South Korean targets. This actor, which ASEC links to North Korean operations and the Lazarus group, has evolved its tradecraft from using the CRAT malware and Hansom ransomware in 2020 to deploying more sophisticated C++ and Go-based variants of Xctdoor in 2026.
The attack chain typically begins with spear phishing emails containing malicious LNK files or compressed archives disguised as security software like Veraport and SoftCamp. Once executed, the malware establishes persistence and grants attackers full remote control, including capabilities for keylogging, screen capture, and credential theft. This activity highlights a persistent threat to corporate and individual users in South Korea through the abuse of trusted software themes.