Analysis of the Connection Between Xctdoor and Past CRAT Attack Cases

Reported 06 Aug 2026 by otx · Severity: medium

A threat actor designated as Larva-26005, linked to North Korea, has been distributing Xctdoor backdoor malware to users in Korea since at least 2020. The campaign evolved from using CRAT malware alongside Hansom ransomware to deploying Xctdoor variants written in C++ and Go. Dis