AhnLab ASEC observed malicious LNK files distributed to South Korean users under a National Tax Service tax-explanation theme. The suspected email-delivered ZIP downloaded from file.gdrive001.com contained a large dummy-padded LNK that ran PowerShell, opened a decoy HWP document, unpacked scripts under Public, and registered start.vbs for RunKey persistence. The script chain collected user information, uploaded it to filehost001.com, and attempted to download ZIP and CAB payloads for execution with rundll32 and batch scripts. ASEC said its infrastructure ultimately identified Qasar RAT and Amadey as final malware, while noting the attacker appeared to keep the malicious download available only briefly to hinder analysis.