2026-01-20상세분석보고서SecureDrive인증으로위장한악성코드_C00kPnt.pdf (958 KB)

Hauri describes phishing emails that impersonate Secure Drive authentication and lure recipients into manually running malware attached to a message abusing the identity of a high-ranking public official. The malware relies on social engineering, obfuscation, security-device evasion, and local execution bypass techniques rather than a purely automated exploit chain. After execution, it attempts to download and run additional payloads from command-and-control infrastructure, although the payload was no longer available at analysis time. The C2 had signs of long-running use against multiple targets, making the campaign relevant for defenders tracking Korean-language phishing and trust-based malware delivery.