Full Report
South Korean authorities and four security firms have disclosed a state-sponsored campaign that compromised trusted domestic websites. The attackers used those sites to exploit locally installed financial-security software and infect targeted visitors with SIGNBT or COPPERHEDGE backdoors. A compromised page could infect a system running a vulnerable AnySign4PC version without a prompt or
Analysis Summary
# Threat Actor: Lazarus Group (Implicit) / Operation Double Barrel
## Attribution & Identity
* **Actor identification:** While the South Korean authorities describe the actor as a "state-sponsored group," the tools and TTPs (SIGNBT, COPPERHEDGE) are historically and technically attributed to North Korean cyber-espionage operations, specifically the **Lazarus Group** (and its sub-groups like Andariel).
* **Known Aliases:** AhnLab refers to this specific 2025–2026 activity as **Operation Double Barrel**.
* **Associated Groups:** Potential overlaps with actors deploying **Gunra ransomware** due to shared infrastructure and SSH fingerprints.
## Activity Summary
* **Campaign:** Ongoing watering-hole and spear-phishing attacks identified from the second half of 2025 through mid-2026.
* **Primary Incident:** A sophisticated zero-day exploitation of **AnySign4PC** (locally installed financial security software) which allowed for "no-prompt" drive-by infections when victims visited compromised legitimate websites.
* **Scope:** Evidence of related attacks found at 72 organizations throughout 2026.
## Tactics, Techniques & Procedures
* **Initial Access:**
* **Watering Hole:** Compromising trusted domestic websites (news, healthcare, education).
* **Spear-Phishing:** Malicious emails disguised as resumes, investment material, and industry surveys (T1566).
* **Exploitation:**
* **Zero-day vulnerability:** Exploited AnySign4PC (v1.1.4.4 - 1.1.4.6) via WebSocket communication.
* **Buffer Overflow:** Triggered via a malicious JavaScript/WebSocket chain to execute shellcode.
* **Execution & Persistence:**
* **Process Injection:** Injecting code into legitimate Microsoft processes and `svchost.exe` (T1055).
* **Registry Storage:** C2 information stored and read from the Windows registry (T1112).
* **Lateral Movement:**
* Use of **Mimikatz** for credential theft (T1003).
* **Remote Desktop Protocol (RDP)** for movement (T1021.001).
* **NLBrute** for brute-forcing network credentials.
## Targeting
* **Sectors:** Finance, Healthcare, Education, Manufacturing, Media (News), and Government/Public Sector.
* **Geography:** Primarily **South Korea**.
* **Victims:** 72 organizations identified; users of certificate-based electronic signature software (AnySign4PC).
## Tools & Infrastructure
* **Malware Families:**
* **SIGNBT 3.0** (AhnLab alias: **Struggle**): A backdoor for remote command execution and file theft.
* **COPPERHEDGE** (AhnLab alias: **Brandoor**): A known North Korean backdoor used for reconnaissance and payload delivery.
* **Gunra Ransomware:** Historically linked via shared network infrastructure.
* **Utilities:** Mimikatz, NLBrute, and malicious DLLs.
* **Infrastructure:**
* Compromised legitimate domestic websites used as watering holes.
* Defanged technical indicator: WebSocket communication to `localhost` to trigger vulnerability.
## Implications
This campaign demonstrates a high level of technical sophistication by leveraging "software-of-trust"—mandatory security applications required for South Korean online banking and government services. By exploiting a zero-day in security software, the threat actor bypassed standard user-interaction prompts, making detection nearly impossible for the average user. This highlights a strategic effort to compromise the South Korean supply chain and trust infrastructure.
## Mitigations
* **Software Updates:** Immediately update **AnySign4PC** to version **1.1.5.0** or higher.
* **Removal:** If the software is not actively required, delete vulnerable installations (1.1.4.4 through 1.1.4.6).
* **Endpoint Monitoring:** Monitor for unusual `svchost.exe` or Microsoft process behavior, specifically looking for unauthorized socket connections or registry modifications by security software binaries.
* **Network Filtering:** Restrict access to known compromised landing pages and monitor for unauthorized RDP movements within the internal network.