Loading story…
South Korean authorities and AhnLab disclosed Operation Double Barrel, a campaign that targeted Korean citizens and businesses from 2025 through the first half of 2026 by exploiting vulnerabilities in Korean financial security software. The activity used watering hole and spear-phishing attacks to direct victims to malicious URLs, after which attackers deployed backdoors including Struggle (also tracked as SIGNBT 3.0) and Brandoor (COPPERHEDGE). Legitimate Korean websites in media, education, healthcare, and manufacturing were abused as part of the watering hole infrastructure, and investigators said the pattern also raised possible supply-chain concerns tied to a shared website development and management company.
The same software flaws were also used in separate intrusions that delivered Gunra ransomware, leading to file encryption and data exfiltration. A joint cybersecurity advisory issued by South Korea's National Intelligence Service, National Police Agency, Korea Internet & Security Agency, and Financial Security Institute said overlapping vulnerabilities, malware characteristics, SSH key fingerprints, and network infrastructure indicate possible limited collaboration or shared tooling between a state-sponsored threat actor and the Gunra ransomware group, although the relationship has not been confirmed definitively.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
A technical analysis report detailed six malware samples from the watering-hole campaign, grouped into three infection-chain types, including a COPPERHEDGE variant, loaders, downloaders, and concealed DLL payloads. The report described persistence, encryption, in-memory loading, anti-analysis techniques, and Korean C2 infrastructure, while noting that some intrusion-chain components remained unconfirmed.
ASEC identified separate incidents in which vulnerabilities in the same Korean financial security software were exploited to deploy Gunra ransomware, resulting in file encryption and data exfiltration. The report linked these incidents to the broader Operation Double Barrel findings through shared vulnerabilities, malware traits, SSH key fingerprints, and infrastructure.
AhnLab ASEC reported that a state-sponsored threat group targeted Korean citizens and businesses by exploiting vulnerabilities in Korean financial security software. The activity used watering hole and spear-phishing attacks and ran from 2025 through the first half of 2026.
Multiple South Korean institutions, including the National Intelligence Service, National Police Agency, Korea Internet & Security Agency, and Financial Security Institute, issued a joint cybersecurity advisory on Operation Double Barrel. The advisory addressed cyberattacks targeting Korean citizens and businesses and discussed the relationship between a state-sponsored threat actor and the Gunra ransomware group.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
6 references tracked. Mallory keeps watching after this page renders.
bsky.app
Open sourcebsky.app
Open sourcemalware.news
Open sourceenki.co.kr
Open sourceasec.ahnlab.com
Open sourceasec.ahnlab.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
South Korean authorities and security researchers disclosed a watering-hole campaign that compromised at least 15 legitimate domestic websites and abused vulnerable **AnySign4PC** software to install the **SIGNBT** and **COPPERHEDGE** backdoors on visitors' systems without user prompts. KISA said versions `1.1.4.4` through `1.1.4.6` were affected by a buffer-overflow flaw enabling remote code execution, with `1.1.5.0` identified as the patched release. Investigators said the activity ran from the second half of 2025 into 2026 and found related targeting across 72 organizations. Technical reporting from ENKI, AhnLab, and other researchers described exploit chains in which malicious JavaScript on hacked sites used WebSocket communication with local security software, executed shellcode, injected into legitimate Microsoft processes, stored encrypted data in the registry, and loaded payloads directly in memory. Separate analysis tied the malware cluster to **SIGNBT** and highlighted overlap with some **Gunra** ransomware intrusions, including shared infrastructure, filenames, exploit paths, and anti-forensic behavior, but the current advisory stopped short of formally attributing the broader campaign or the ransomware activity to the same operator.
Jul 31, 2026
A significant increase in ransomware attacks has been observed, driven by alliances between major ransomware groups and a surge in activity from the Qilin group. Qilin accounted for nearly 29% of all ransomware attacks in October 2025, with industrials, consumer discretionary, and healthcare sectors being the most targeted. North America experienced the majority of these attacks, but South Korea saw a notable spike, particularly in its financial sector, due to a sophisticated supply chain attack involving a compromised Managed Service Provider (MSP). This campaign, dubbed 'Korean Leaks,' resulted in 25 South Korean financial institutions being hit in September alone, a dramatic rise from previous months. The Qilin group operates as a Ransomware-as-a-Service (RaaS) and has demonstrated explosive growth, leveraging affiliates that include state-linked actors such as North Korea's Moonstone Sleet. The attack on South Korea's financial sector highlights the evolving tactics of ransomware groups, including the use of MSPs as initial access vectors and the blending of criminal and state-sponsored operations. The ongoing alliances and technical sophistication of these groups are expected to drive further increases in ransomware activity, especially during high-traffic periods like the end-of-year holidays.
Jun 29, 2026
North Korea-aligned threat actor **Kimsuky** has expanded operations across its **AppleSeed** and **PebbleDash** intrusion clusters, using spear-phishing documents to gain initial access and then deploying a broader malware set that includes **HelloDoor**, **httpMalice**, **MemLoad**, **httpTroy**, **AppleSeed**, and **HappyDoor**. Researchers assess with medium-high confidence that both clusters are operated by Kimsuky-affiliated actors, also tracked as **APT43** and **Ruby Sleet**, with AppleSeed showing a stronger focus on government organizations while PebbleDash activity has also reached defense-related entities in Brazil and Germany in addition to South Korean targets. The campaigns show a notable shift in post-compromise tradecraft, with operators increasingly abusing legitimate remote administration and tunneling tools such as **VSCode Remote Tunneling**, **DWAgent**, and **Cloudflare Quick Tunnels** for persistence and access. The report also notes malware development changes including the use of **Rust**, probable LLM-assisted code comments, and continued reliance on infrastructure patterns tied to free South Korean hosting domains and compromised South Korean websites, indicating that Kimsuky is modernizing its tooling while preserving long-standing operational habits.
Jun 29, 2026