Windows Users at Risk – How PDFs and LNK Files Are Being Exploited by Hackers

A sophisticated cyber espionage operation, known as Operation HanKook Phantom, has recently come to light, exposing Windows users across Asia and the Middle East to an advanced threat that utilizes weaponized PDFs and Windows shortcut files (LNK) as its primary infection vectors.

The campaign, uncovered by researchers at Seqrite Lab, has been linked to the North Korean state-sponsored group APT-37, also known as ScarCruft or InkySquid, which is renowned for spear-phishing and intelligence-driven cyberattacks.

Windows Users at Risk

At the heart of Operation HanKook Phantom lies a highly targeted spear-phishing strategy. Victims, often from government, defense, academic, and research organizations, receive archives containing what appears to be a legitimate internal newsletter, specifically the “National Intelligence Research Society Newsletter.”

Embedded alongside the real PDF document is a malicious LNK file, cunningly named to mimic the genuine article. Once the LNK file is executed, it does not merely open a document; instead, it triggers a concealed PowerShell-based payload extraction and execution process.

This phase retrieves both the legitimate-appearing PDF and several malicious binaries encoded within the shortcut file itself, storing them inconspicuously within the system’s temporary folders.

The targets of this campaign include not only academics and former officials in South Korea but also institutions in Japan, Vietnam, India, China, Russia, and the Middle East, demonstrating a broad geographical scope and an intent to access sensitive policy and research intelligence.

How PDFs and LNK Files Are Being Exploited

The technical execution of this campaign demonstrates a significant leap in evasion techniques. The embedded PowerShell scripts within the LNK file locate and extract multiple payloads by reading from precise binary offsets, dropping both a decoy PDF and a series of encrypted files typically named in a way that arouses slight suspicion.

Following extraction, a batch script serves as a loader for additional PowerShell components, ensuring that the subsequent stages of malware execution remain exclusively in memory.

In this chain, decryption routines are applied using a simple XOR operation to unlock the final malware binary, which is then injected via direct Windows API calls without ever touching the disk in its decrypted state.

This approach not only minimizes forensic footprints but also bypasses traditional file-based antivirus detections.

The final malware is capable of complete system reconnaissance: gathering host fingerprints, evading virtual analysis by detecting sandbox tools, taking screenshots, and uploading sensitive information.

Cloud Services as Stealthy Command and Control

Perhaps what sets Operation HanKook Phantom apart is its innovative abuse of popular cloud services for command-and-control communications.

The malware does not connect directly to suspicious or obscure servers; instead, it leverages legitimate platforms like Dropbox, pCloud, and Yandex Disk, embedding C2 commands and data exfiltration traffic within routine cloud interactions.

The malware uploads stolen documents, employing browser-mimicking HTTP POST requests that disguise payloads as PDF uploads, and then erases traces from the local system.

By utilizing familiar cloud APIs and using techniques to erase evidence, attackers maintain persistent, low-profile access and reduce the likelihood of detection.

This campaign emphasizes the importance of organizations adopting advanced monitoring, with a particular focus on LNK file delivery, PowerShell activity, and anomalous cloud service traffic, to prevent espionage and data theft on Windows systems.

Find this Story Interesting! Follow us on Google News , LinkedIn and X to Get More Instant Updates