ASEC analyzed a Korean campaign distributing a malicious LNK file disguised as a National Tax Service income-tax clarification package. The ZIP was delivered from a file.gdrive001.com URL and briefly contained a large LNK plus a benign HWP decoy; the LNK used PowerShell and batch/VBS scripts to show the decoy, create files under %Public%, persist through the Run key, collect process and user-folder listings, and upload them to filehost001.com. The chain attempted to fetch additional ZIP and CAB payloads, and AhnLab telemetry ultimately observed Qasar RAT and Amadey execution. The report lists related Korean lures and hashes, showing an active LNK-based delivery pattern against Korean users.