Since early 2026, Windows shortcut files (LNK) with names with the same pattern have been consistently identified by VirusTotal. The LNK files are disguised as image and video files, and when executed, they receive and execute a PowerShell script from the attacker's server, download NodeJS, and ultimately execute the TonRAT malware written in JavaScript.As a result of checking an external report [1], it was confirmed that the LNK files were distributed to overseas travel agency employees and related lodging companies. TonRAT malware accesses the specific contract 0:c66119f0e5635c4380441d7a79baf0c02a0ab7ea6cd78de06507fc5dc2c1a5d9 of the TON (The Open Network) blockchain developed by Telegram, obtains the C&C server domain address, and receives commands through WebSocket. In addition, the function of receiving a PE file from an external URL, loading it into memory and executing it, and a self-update function are implemented, allowing the attacker to execute additional payload.The TonRAT malware applies a commercial function (VM obfuscation) of obfuscator.io, a JavaScript obfuscation tool, so the functions that perform major malicious actions are virtualized, making static and dynamic analysis difficult. Afterwards, the attacker continued to update and redistribute the malware at a rapid rate, and also continuously changed the obfuscation pattern.

Understanding the root cause of PHP2Shell requires some familiarity with how PHP manages memory internally and how the Zend Engine represents and manages data.2.1 Request Memory and Process-Scoped StateWhile handling an HTTP request, PHP stores the strings, arrays, objects, and other values created during that request in per-request memory. This memory is released when the request completes. Under Apache mod_php or PHP-FPM, however, a single process serves many HTTP requests in succession, so the process itself—and part of its internal state—persists after each request ends. Internal state here does not refer to $GLOBALS in PHP code, but to values that PHP Core and extension modules maintain at the C level.Data inside PHP can therefore be divided into two categories: request-scoped data, which is valid only for the duration of a single request, and process-scoped state, which survives across requests.2.2 Zend Engine and Core Data StructuresThe Zend Engine is the core component of PHP responsible for interpreting and executing PHP code. It compiles PHP code into opcodes and executes them, and it handles the primary functions of the PHP runtime, including function calls, variable and object management, memory allocation, and error handling.Every value in PHP is represented by a zval data structure. A zval holds either the actual value or a pointer to another data structure, along with type information describing what kind of value it contains.PHP arrays and several internal symbol tables are implemented as a HashTable. Each element of a HashTable is stored in a Bucket, which consists of a zval holding the value, the hash of the key, and a pointer to the string key.A HashTable tracks the range of the Bucket array to be traversed via nNumUsed, and the number of currently valid elements via nNumOfElements. When a HashTable is destroyed, the Zend Engine iterates over the Bucket array up to nNumUsed, releasing each valid zval according to its type information and the pDestructor registered on the HashTable.2.3 Out-of-Memory and BailoutPHP limits the maximum amount of memory a single request may consume through the memory_limit setting.Even when the system still has physical memory available, a request that exceeds the configured memory_limit triggers an out-of-memory (OOM) error inside PHP.To abort execution when a fatal error occurs, the Zend Engine uses a bailout mechanism. Rather than having each C function propagate the error back to its caller in turn, bailout transfers control directly to a predefined recovery point.The Zend Engine’s zend_try registers the current execution point as a recovery point using setjmp(). When zend_bailout() is later called from a nested function, longjmp() transfers control to the most recently registered recovery point, and execution resumes in the corresponding zend_catch block.In this process, none of the functions between the current call site and the recovery point go through a normal return. Any remaining code in those functions is never executed—including cleanup logic that should have run before the function returned.The next section examines how these memory management mechanisms and data structures tie into the root cause of each vulnerability.

엔키화이트햇 위협연구팀은 한국과 일본을 대상으로 한 Kimsuky의 최신 스피어피싱 사례를 다수 식별하였다. 공격자는 OneDrive 공유 링크가 포함된 피싱 이메일로 악성코드를 유포하였으며, 침투 이후에는 파워쉘 스크립트와 합법 원격 제어 도구를 악용해 데이터를 유출하고 피해 시스템을 제어하였다.caption - 공격 개요도공격자는 짧은 주기로 악성코드의 C&C 서버를 변경하고 정상 한국 서버를 침해해 C&C 서버로 악용하는 등 추적을 어렵게 하는 인프라 운용 전략을 사용하였다. 또한 Gmail 유출에 사용된 악성 크롬 확장 프로그램의 코드에서는 한국어로 작성된 상세한 주석과 디버깅 문자열, 유니코드 이모지 등 생성형 AI로 작성된 코드의 특징이 다수 확인되었다.공격자는 악성코드 압축파일을 OneDrive에 업로드하고, 해당 파일의 공유 링크가 포함된 피싱 이메일을 피해자에게 전송하였다. 확보한 일본 피해자 타겟 이메일에서는 "자료를 보내드리겠습니다. 확인 부탁드립니다."라는 일본어 문구와 함께 OneDrive 링크가 전송된 것이 확인되었다.