AhnLab’s September 2026 Infostealer Report Details Distribution and Lzveil Behavior

Summary

AhnLab ASEC’s September 2026 report draws on detection logs and collected samples to describe infostealer distribution, disguises, and targets. It details Lzveil’s data collection and command-and-control behavior, plus email delivery of DarkCloud and AgentTesla.

Key points

The report uses ASEC and AhnLab product detection logs, automated sample collection, and email honeypot data gathered during September 2026.
Infostealers disguised as cracked software and keygens were distributed through SEO poisoning and other channels, including websites and email.
EXE files accounted for about 90.8% of samples; DLL side-loading accounted for about 9.2%.
The Rust-based Lzveil downloads configuration from a C2 server, decrypts strings with a modified Base64 algorithm, and uses XOR encryption and LZNT1 compression for C2 communications.
Lzveil sends installed-program, CPU, and driver information to its C2 server; its response may trigger installation of additional malware.
Emails impersonating a Qatari construction company and a logistics company distributed DarkCloud and AgentTesla, respectively. The report lists the types of information DarkCloud steals and channels AgentTesla can use to transmit stolen data.
The report recommends avoiding untrusted links and attachments and illegal software, enabling 2FA, and keeping security software up to date.

Article Details

Publisher: AhnLab SEcurity intelligence Center (ASEC)
Report Period: September 2026
Scope: Infostealer distribution channels, sample and detection counts, and companies targeted; based on ASEC and AhnLab product detection logs and collected samples.
Key Statistics: EXE files accounted for approximately 90.8% of the observed distribution.
DLL side-loading accounted for approximately 9.2% of the observed distribution.
Recommendations: Be cautious of untrusted links and attachments.
Avoid using illegal software.
Enable two-factor authentication (2FA).
Keep security software up to date.

Indicators of compromise

Type	Indicator	Context
MD5	`00af13db61bc4d075996d052faf6cdf2`	MD5 listed in the report's malware-indicator section; the specific malware family is not identified.
MD5	`015e4dfcffca0c0bde10b6c52ab2e947`	MD5 listed in the report's malware-indicator section; the specific malware family is not identified.
MD5	`02982429f7efd81338a4efd1fb6cb556`	MD5 listed in the report's malware-indicator section; the specific malware family is not identified.
MD5	`02b6374ff05ea4a0aa79f197f01e710f`	MD5 listed in the report's malware-indicator section; the specific malware family is not identified.
MD5	`035a4128d5bdf5d333f17f0e62b4fa3c`	MD5 listed in the report's malware-indicator section; the specific malware family is not identified.