DPRK-Related Campaigns with LNK and GitHub C2

Reported 03 Apr 2026 by otx · Severity: medium

FortiGuard Labs recently detected a series of LNK files targeting users in South Korea. These attacks use a multi-stage scripting process and leverage GitHub as Command and Control (C2) infrastructure to evade detection. Although these LNK files can be traced back to 2024, earlie