AhnLab ASEC blog (asec.ahnlab.com)
Analysis of the Connection Between Xctdoor and Past CRAT Attack Cases (Larva-26005) · 2026-08-04
excerpt: 1. Overview AhnLab SEcurity intelligence Center (ASEC) recently confirmed that the Larva-26005 threat actor is distributing Xctdoor to users in Korea. Xctdoor was disclosed through the ASEC blog in 2024, and [1] In March 2026, Hauri disclosed an attack case in which the malware was disguised as an integrated security program. [2] While analyzing the […] | attribution sentence: Overview AhnLab SEcurity intelligence Center (ASEC) recently confirmed that the Larva-26005 threat actor is distributing Xctdoor to users in Korea. | target sentence: CRAT was first identified in 2020 and was used in various attack cases targeting South Korean users, including spear phishing attacks and distribution via uploads to domestic community sites.