NarwhalRAT Deployed via LNK Files, PowerShell, and Python Loader

Key Takeaways

• A sophisticated malware campaign is actively targeting users in South Korea.
• The campaign deploys NarwhalRAT, a full-featured Remote Access Trojan, through a multi-stage infection chain.
• Initial compromise occurs via spear-phishing emails containing malicious LNK files disguised as security alerts.
• The attackers use Living-off-the-Land techniques, abusing PowerShell, curl.exe, and Python to evade detection.
• NarwhalRAT establishes persistence and employs a dual command-and-control (C2) infrastructure, including a Korean relay server and pCloud as a dead-drop resolver.

A covert and highly organized malware campaign is currently targeting South Korean users, deploying the advanced NarwhalRAT remote access trojan. This operation employs a complex chain of attack vectors, leveraging seemingly innocuous shortcut files, legitimate Windows utilities, and a Python-based loader to infiltrate victim systems.

The threat actors have meticulously designed their attack to blend seamlessly into routine system operations, making detection challenging for conventional security measures. Researchers at Genians Security Center, in a report shared with Cyber Security News (CSN), noted striking similarities between this campaign and a Python-based backdoor operation documented in May 2026.

The malware, dubbed NarwhalRAT by researchers, derives its name from the embedded string “naverwhale,” a deliberate attempt to impersonate Naver Whale, a widely used web browser in South Korea.

Initial Infection Vector and Evasion

The attack commences with a spear-phishing email masquerading as an urgent security alert from the “Microsoft Account Team.” This deceptive message warns recipients of suspicious one-time password activity and prompts them to open an attached “advisory document.” In reality, the attachment is a ZIP archive containing a malicious LNK shortcut file, not a legitimate document.

Upon execution, the LNK file initiates a multi-layered infection process. It employs CMD environment variable substring substitution to obfuscate commands, dynamically reconstructing strings like “powershell” and “curl.exe” at runtime. This technique is specifically designed to bypass static detection mechanisms.

Following deobfuscation, the LNK file executes PowerShell, bypassing execution policies. It then uses a copied version of curl.exe to download two files from a relay server. The first is a decoy HWP document, displayed to the victim to maintain the illusion of a legitimate security advisory. Concurrently, a batch script named KHjWFcuS.bat is downloaded and executed in a hidden window, commencing the next stage of the installation.

This method of exploiting built-in operating system tools is a classic example of “Living-off-the-Land” (LotL) tactics. The batch file proceeds to download the official Python embedded package, further camouflaging the malicious activity as a standard software installation. Pythonw.exe is then renamed to usersscreen.exe to prevent any console window from appearing, ensuring silent execution. The final payload, named config.cat, is disguised with a .cat extension to mimic a Windows security catalog file, but it is, in fact, compiled Python bytecode functioning as a backdoor loader.

Persistence and C2 Infrastructure

For persistence, NarwhalRAT creates a scheduled task named “MicrosoftUserInterfacePicturesUpdateTackMachine,” designed to run at one-minute intervals. This name deliberately mimics a legitimate Microsoft task, making it difficult for system administrators to identify during routine inspections. Subsequently, another file, AccountConfig.cat, is introduced, containing over 33,000 lines of heavily obfuscated code and an embedded Base64-encoded payload.

NarwhalRAT’s operational structure confirms its focus on Korean targets. It utilizes “naverwhale” as its working directory name and applies Hidden and System file attributes to the created folder for stealth. Furthermore, it specifically handles KakaoTalk-related window identifiers during data collection, reinforcing its targeted nature.

The threat actor maintains a sophisticated dual command-and-control (C2) architecture. This includes a primary Korean relay server and the pCloud API, which serves as a Dead-drop Resolver. This dual setup allows the attackers to modify the actual C2 address without altering the malware itself, while also enabling C2 traffic to blend with normal web activity, significantly complicating detection efforts.

NarwhalRAT Capabilities and C2 Communication

Once the payload executes in memory via fileless techniques, NarwhalRAT reveals its full capabilities as a robust Remote Access Trojan. A critical initial step for the RAT is to check for virtual machine environments such as VMware, VirtualBox, and Parallels Desktop. This anti-analysis tactic is characteristic of advanced persistent threat (APT) malware, designed to evade sandbox detection.

The RAT operates a comprehensive command system, utilizing over 30 distinct prefixes. This extensive control panel grants the attackers capabilities including, but not limited to, screen capture, keylogging, microphone recording, file upload and download, USB device data exfiltration, remote command execution, and dynamic C2 configuration changes. Keystroke data is buffered and transmitted in batches, further reducing the chances of real-time detection by security solutions.

From a C2 communication standpoint, NarwhalRAT connects to Korean relay sites, specifically daehoat[.]com and novel21[.]co[.]kr. It also leverages pCloud as a secondary Dead-drop Resolver channel. Security researchers emphasize the need for enhanced EDR policies to detect chained abuses involving LNK files and PowerShell. Security teams should implement behavioral rules to flag unusual scheduled task creation, unexpected usage of curl.exe, and Python processes operating without a visible console window.

Indicators of Compromise (IoCs)

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

What You Should Do

• Strengthen Email Security: Implement robust email gateway protections to detect and block spear-phishing attempts, especially those with suspicious attachments like LNK files within ZIP archives.
• Enhance Endpoint Detection and Response (EDR): Configure EDR solutions to monitor for unusual process chains, particularly those involving LNK file execution leading to PowerShell or curl.exe activity.
• Implement Behavioral Anomaly Detection: Create alerts for atypical scheduled task creation, especially tasks with names mimicking legitimate system processes but exhibiting unusual execution patterns or intervals (e.g., “MicrosoftUserInterfacePicturesUpdateTackMachine” running every minute).
• Monitor for Living-off-the-Land (LotL) Abuse: Watch for unexpected usage of built-in Windows tools such as PowerShell, curl.exe, and cmd.exe, especially when invoked by non-standard processes or with obfuscated command-line arguments.
• Scrutinize Python Process Behavior: Look for Python processes (including renamed executables like usersscreen.exe) running without a visible console window, as this is a common tactic for silent malware execution.
• User Awareness Training: Educate users about the dangers of spear-phishing, the importance of verifying sender identities, and the risks associated with opening unsolicited attachments, even if they appear to be from trusted sources.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.