DPRK-Related Campaigns with LNK and GitHub C2

FortiGuard Labs recently detected a series of LNK files targeting users in South Korea. These attacks use a multi-stage scripting process and leverage GitHub as Command and Control (C2) infrastructure to evade detection. Although these LNK files can be traced back to 2024, earlier versions had less obfuscation and contained significant metadata, allowing us to track similar attacks spreading the XenoRAT malware.

Pulse ID: 69cfceee4f7a6c4305b3d1a4
Pulse Link: https://otx.alienvault.com/pulse/69cfceee4f7a6c4305b3d1a4
Pulse Author: AlienVault
Created: 2026-04-03 14:30:06

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#CyberSecurity #DPRK #FortiGuard #FortiGuardLabs #GitHub #InfoSec #Korea #LNK #Malware #OTX #OpenThreatExchange #RAT #SouthKorea #bot #AlienVault

The categorization of the Fortinet web filter is hilarious. I got a report that a certain website is incorrectly blocked by our firewall. After looking into it, the specific website belongs to a large organization.

Different organizational levels of this large organization are categorized as:

• Political organization (federal level)
• General organization (state level)
• Advocacy organization (local level), giving it an R age rating (18+)

The “correct” classification should be either general organization or simply “business”.

This is wrong on many levels. Why are advocacy groups blocked by default? Why do they have an R rating (because politics is only for adults? But then why only advocacy groups and not political organizations?).

#fortinet #fortigate #fortiguard

I have updated my blog to different yet suitable theme. Everything is good but this one anomaly. When I open one menu from the blog, the browser will redirect the tab to http (and cause fortiguard alert). Changing the http to https manually from the browser fix the problem. What is the problem? my server running nginx and inside the config, there is a directive to redirect http to https (normal configuration)

note: when using freebsd (current laptop), error/block never occurred

#fortiguard #web #hugo